oscerd commented on PR #142: URL: https://github.com/apache/camel-kit/pull/142#issuecomment-6572624219
Thanks for the careful review — both P2 findings are addressed in `76ff611` + `666d988` (follow-up commits, so the delta is visible rather than a force-push): **1. Corrected rationale.** You're right: the indexer pins SnakeYAML 2.3, whose default `UnTrustedTagInspector` already rejects custom global tags before construction, so `new Yaml()` does not permit arbitrary instantiation here. I rewrote the code comments, the follow-up commit message, the PR description, and issue #139 to frame `SafeConstructor` as defense-in-depth (removes arbitrary-object construction + makes data-only intent explicit), with no demonstrated end-user vulnerability — matching your suggested wording. **2. Tagged-input regression tests.** Added `VersionResolverTest.rejectsGloballyTaggedReleaseFrontmatterWithoutConstructing` and `CveParserTest.cveGlobalTagFallsBackToLineExtractionWithoutConstructing`, each exercising **both** the `!!Class` shorthand and the verbose `!<tag:yaml.org,2002:Class>` form. A construction canary (a public class whose constructor flips a static flag) proves non-construction: release parsing rejects the YAML, CVE parsing falls back to line-based extraction, and the canary stays `false`. Reverting either loader to a full `Constructor` + permissive `TagInspector` flips the canary and fails the tests. VersionResolverTest 13, CveParserTest 5, CveEnrichmentTest 22 pass; `-Psourcecheck validate` clean. _AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
