This is an automated email from the ASF dual-hosted git repository. luigidemasi pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-kit.git
commit e0f10e479d2c865267da196d25c616a7150bc6a2 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Nov 2 09:30:53 2026 +0100 Fix #139: also cover the verbose !<tag:...> global-tag form in tests Per review, exercise both the !!Class shorthand and the verbose !<tag:yaml.org,2002:Class> form of the global tag in the SafeConstructor regression tests for VersionResolver and CveParser. Co-authored-by: Claude Opus 4.8 <[email protected]> --- .../kit/knowledge/indexer/VersionResolverTest.java | 22 +++++++------ .../knowledge/indexer/parser/CveParserTest.java | 37 ++++++++++++---------- 2 files changed, 33 insertions(+), 26 deletions(-) diff --git a/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/VersionResolverTest.java b/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/VersionResolverTest.java index 90af7136..b60c6f14 100644 --- a/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/VersionResolverTest.java +++ b/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/VersionResolverTest.java @@ -389,15 +389,19 @@ class VersionResolverTest { @Test void rejectsGloballyTaggedReleaseFrontmatterWithoutConstructing() throws Exception { - Canary.constructed = false; Path releasesDir = Files.createDirectories(tempDir.resolve("content/releases")); - Files.writeString(releasesDir.resolve("release-4.14.0.md"), - "---\ncategory: camel\ndate: 2026-01-15\npwn: !!" + Canary.class.getName() + " {}\n---\nBody.\n"); - - // SafeConstructor refuses the global tag during composition, before any construction. - assertThrows(org.yaml.snakeyaml.error.YAMLException.class, - () -> VersionResolver.parseReleases(tempDir)); - assertFalse(Canary.constructed, - "SafeConstructor must not instantiate a globally tagged type in release frontmatter"); + // Both the !! shorthand and the verbose !<tag:...> form of the same global tag. + for (String tag : List.of("!!" + Canary.class.getName() + " {}", + "!<tag:yaml.org,2002:" + Canary.class.getName() + "> {}")) { + Canary.constructed = false; + Files.writeString(releasesDir.resolve("release-4.14.0.md"), + "---\ncategory: camel\ndate: 2026-01-15\npwn: " + tag + "\n---\nBody.\n"); + + // SafeConstructor refuses the global tag during composition, before any construction. + assertThrows(org.yaml.snakeyaml.error.YAMLException.class, + () -> VersionResolver.parseReleases(tempDir)); + assertFalse(Canary.constructed, + "SafeConstructor must not instantiate a globally tagged type: " + tag); + } } } diff --git a/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/parser/CveParserTest.java b/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/parser/CveParserTest.java index 2d7c4b29..a82c95c4 100644 --- a/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/parser/CveParserTest.java +++ b/knowledge/indexer/src/test/java/org/apache/camel/kit/knowledge/indexer/parser/CveParserTest.java @@ -63,24 +63,27 @@ class CveParserTest { @Test void cveGlobalTagFallsBackToLineExtractionWithoutConstructing() { - Canary.constructed = false; - String content = "---\n" - + "cve: CVE-2099-0001\n" - + "severity: HIGH\n" - + "summary: \"Canary advisory\"\n" - + "pwn: !!" + Canary.class.getName() + " {}\n" - + "fixed: \"4.0.4, 3.21.4\"\n" - + "---\n" - + "Body referencing CAMEL-12345.\n"; + // Both the !! shorthand and the verbose !<tag:...> form of the same global tag. + for (String tag : java.util.List.of("!!" + Canary.class.getName() + " {}", + "!<tag:yaml.org,2002:" + Canary.class.getName() + "> {}")) { + Canary.constructed = false; + String content = "---\n" + + "cve: CVE-2099-0001\n" + + "severity: HIGH\n" + + "summary: \"Canary advisory\"\n" + + "pwn: " + tag + "\n" + + "fixed: \"4.0.4, 3.21.4\"\n" + + "---\n" + + "Body referencing CAMEL-12345.\n"; - // The global tag makes SafeConstructor throw; parseYamlFrontmatter catches it and falls - // back to line-based regex extraction, so the advisory still parses and nothing is constructed. - CveParser.CveAdvisory cve = CveParser.parse(content); + // The global tag makes SafeConstructor throw; parseYamlFrontmatter catches it and falls + // back to line-based regex extraction, so the advisory still parses and nothing is constructed. + CveParser.CveAdvisory cve = CveParser.parse(content); - assertFalse(Canary.constructed, - "SafeConstructor must not instantiate a globally tagged type in CVE frontmatter"); - assertEquals("CVE-2099-0001", cve.cveId()); - assertEquals("HIGH", cve.severity()); - assertTrue(cve.fixedVersions().contains("4.0.4")); + assertFalse(Canary.constructed, "SafeConstructor must not instantiate a globally tagged type: " + tag); + assertEquals("CVE-2099-0001", cve.cveId()); + assertEquals("HIGH", cve.severity()); + assertTrue(cve.fixedVersions().contains("4.0.4")); + } } }
