This is an automated email from the ASF dual-hosted git repository. luigidemasi pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-kit.git
commit 9f3a3e7c8901e66e8f83c59ea995a24b945e4dfd Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Oct 30 10:24:48 2026 +0100 Fix #139: use SnakeYAML SafeConstructor in the indexer Parse YAML frontmatter with new Yaml(new SafeConstructor(new LoaderOptions())) in VersionResolver and CveParser. The data is plain maps/lists/scalars, so a SafeConstructor that refuses arbitrary type tags (!!type) is sufficient and removes the default Constructor's type-instantiation surface. Build-time, trusted-input hardening. Co-authored-by: Claude Opus 4.8 <[email protected]> --- .../java/org/apache/camel/kit/knowledge/indexer/VersionResolver.java | 5 ++++- .../org/apache/camel/kit/knowledge/indexer/parser/CveParser.java | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/VersionResolver.java b/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/VersionResolver.java index 9781832a..2444eeb7 100644 --- a/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/VersionResolver.java +++ b/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/VersionResolver.java @@ -24,7 +24,9 @@ import java.util.regex.Pattern; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.yaml.snakeyaml.LoaderOptions; import org.yaml.snakeyaml.Yaml; +import org.yaml.snakeyaml.constructor.SafeConstructor; /** * Resolves active Apache Camel versions, their Git tags across three repos (camel, camel-spring-boot, camel-quarkus), @@ -92,7 +94,8 @@ public class VersionResolver { } List<CamelRelease> releases = new ArrayList<>(); - Yaml yaml = new Yaml(); + // Frontmatter is plain data (maps/lists/scalars); SafeConstructor refuses arbitrary type tags. + Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions())); // Only top-level release files (not subdirectories like q/, sb/, etc.) try (DirectoryStream<Path> stream = Files.newDirectoryStream(releasesDir, "release-*.md")) { diff --git a/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/parser/CveParser.java b/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/parser/CveParser.java index 8d8de010..fd7e493f 100644 --- a/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/parser/CveParser.java +++ b/knowledge/indexer/src/main/java/org/apache/camel/kit/knowledge/indexer/parser/CveParser.java @@ -26,7 +26,9 @@ import org.json.JSONArray; import org.json.JSONObject; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.yaml.snakeyaml.LoaderOptions; import org.yaml.snakeyaml.Yaml; +import org.yaml.snakeyaml.constructor.SafeConstructor; /** * Parses Apache Camel CVE advisories from Markdown files with YAML frontmatter. Optionally enriches with NVD data (CVSS @@ -326,7 +328,8 @@ public class CveParser { @SuppressWarnings("unchecked") private static Map<String, Object> parseYamlFrontmatter(String frontmatter) { try { - Object parsed = new Yaml().load(frontmatter); + // Frontmatter is plain data; SafeConstructor refuses arbitrary type tags (!!type). + Object parsed = new Yaml(new SafeConstructor(new LoaderOptions())).load(frontmatter); return parsed instanceof Map ? (Map<String, Object>) parsed : null; } catch (Exception e) { LOG.warn(" Frontmatter is not valid YAML, falling back to line-based extraction: {}", e.getMessage());
