Use SafeConstructor in Snakeyaml YAML constructors

BoykoAlex · BoykoAlex · commit 2d841f78fc4c · 2022-10-18T16:37:42.000-04:00
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/deployment/ApplicationManifestHandler.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/deployment/ApplicationManifestHandler.java
@@ -50,6 +50,7 @@
 import org.yaml.snakeyaml.DumperOptions.FlowStyle;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.constructor.SafeConstructor;
+import org.yaml.snakeyaml.representer.Representer;
 
 import com.google.common.collect.ImmutableList;
 
@@ -386,7 +387,7 @@ public boolean create(IProgressMonitor monitor, CloudApplicationDeploymentProper
 		options.setCanonical(false);
 		options.setPrettyFlow(true);
 		options.setDefaultFlowStyle(FlowStyle.BLOCK);
-		Yaml yaml = new Yaml(options);
+		Yaml yaml = new Yaml(new SafeConstructor(), new Representer(options), options);
 		String manifestValue = yaml.dump(deploymentInfoYaml);
 
 		if (manifestValue == null) {
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/deployment/ApplicationNameReconciler.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/deployment/ApplicationNameReconciler.java
@@ -16,6 +16,7 @@
 import org.eclipse.jface.text.source.ISourceViewer;
 import org.springframework.ide.eclipse.editor.support.yaml.ast.YamlASTProvider;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 /**
  * Reconciler for Application names in CF deployment manifest YAML
@@ -29,7 +30,7 @@ public class ApplicationNameReconciler extends Reconciler {
 
 	public ApplicationNameReconciler() {
 		super();
-		YamlASTProvider parser = new YamlASTProvider(new Yaml());
+		YamlASTProvider parser = new YamlASTProvider(new Yaml(new SafeConstructor()));
 		strategy= new AppNameReconcilingStrategy(parser);
 		this.setReconcilingStrategy(strategy, IDocument.DEFAULT_CONTENT_TYPE);
 	}
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/deployment/YamlGraphDeploymentProperties.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/deployment/YamlGraphDeploymentProperties.java
@@ -42,6 +42,7 @@
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.composer.Composer;
 import org.yaml.snakeyaml.constructor.Constructor;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.nodes.MappingNode;
 import org.yaml.snakeyaml.nodes.Node;
 import org.yaml.snakeyaml.nodes.NodeTuple;
@@ -50,6 +51,7 @@
 import org.yaml.snakeyaml.nodes.Tag;
 import org.yaml.snakeyaml.parser.ParserImpl;
 import org.yaml.snakeyaml.reader.StreamReader;
+import org.yaml.snakeyaml.representer.Representer;
 import org.yaml.snakeyaml.resolver.Resolver;
 
 import com.google.common.base.Objects;
@@ -98,7 +100,8 @@ private void initializeYaml(String appName) {
 			appNode = (MappingNode) root;
 		}
 
-		this.yaml = new Yaml(createDumperOptions());
+		DumperOptions options = createDumperOptions();
+		this.yaml = new Yaml(new SafeConstructor(), new Representer(options), options);
 	}
 
 	private static MappingNode findAppNode(SequenceNode seq, String name) {
@@ -252,7 +255,7 @@ public MultiTextEdit getDifferences(DeploymentProperties props) {
 				options.setPrettyFlow(true);
 				options.setDefaultFlowStyle(FlowStyle.BLOCK);
 				options.setLineBreak(LineBreak.getPlatformLineBreak());
-				edits.addChild(new ReplaceEdit(0, content.length(), new Yaml(options).dump(obj)));
+				edits.addChild(new ReplaceEdit(0, content.length(), new Yaml(new SafeConstructor(), new Representer(options), options).dump(obj)));
 			} else {
 				edit = addLineBreakIfMissing(applicationsValueNode.getEndMark().getIndex());
 				if (edit != null) {
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/dialogs/DeploymentPropertiesDialogModel.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/dialogs/DeploymentPropertiesDialogModel.java
@@ -58,6 +58,8 @@
 import org.springsource.ide.eclipse.commons.livexp.util.Log;
 import org.yaml.snakeyaml.DumperOptions;
 import org.yaml.snakeyaml.DumperOptions.FlowStyle;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
+import org.yaml.snakeyaml.representer.Representer;
 import org.yaml.snakeyaml.Yaml;
 
 @SuppressWarnings("restriction")
@@ -919,7 +921,7 @@ private String generateDefaultContent() {
 		options.setCanonical(false);
 		options.setPrettyFlow(true);
 		options.setDefaultFlowStyle(FlowStyle.BLOCK);
-		return new Yaml(options).dump(yaml);
+		return new Yaml(new SafeConstructor(), new Representer(options), options).dump(yaml);
 	}
 
 
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/model/CloudFoundryBootDashModel.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.cf/src/org/springframework/ide/eclipse/boot/dash/cf/model/CloudFoundryBootDashModel.java
@@ -103,7 +103,10 @@
 import org.springsource.ide.eclipse.commons.livexp.util.ExceptionUtil;
 import org.springsource.ide.eclipse.commons.livexp.util.Log;
 import org.springsource.ide.eclipse.commons.livexp.util.OldValueDisposer;
+import org.yaml.snakeyaml.DumperOptions;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
+import org.yaml.snakeyaml.representer.Representer;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
@@ -557,6 +560,7 @@ public CloudApplicationDeploymentProperties resolveDeploymentProperties(CloudApp
 					final String yamlContents = IOUtil.toString(manifestFile.getContents());
 					String errorMessage = null;
 					TextEdit edit = null;
+					DumperOptions options = YamlGraphDeploymentProperties.createDumperOptions();
 					try {
 						YamlGraphDeploymentProperties yamlGraph = new YamlGraphDeploymentProperties(yamlContents, deploymentProperties.getAppName(), cloudData);
 						MultiTextEdit me = yamlGraph.getDifferences(deploymentProperties);
@@ -568,13 +572,13 @@ public CloudApplicationDeploymentProperties resolveDeploymentProperties(CloudApp
 						Log.log(e);
 						errorMessage = "Failed to create text differences between local manifest file and deployment properties on CF. Merge with caution.";
 						edit = new ReplaceEdit(0, yamlContents.length(),
-								new Yaml(YamlGraphDeploymentProperties.createDumperOptions())
+								new Yaml(new SafeConstructor(), new Representer(options), options)
 										.dump(ApplicationManifestHandler.toYaml(deploymentProperties, cloudData)));
 					} catch (Throwable t) {
 						Log.log(t);
 						errorMessage = "Failed to parse local manifest file YAML contents. Merge with caution.";
 						edit = new ReplaceEdit(0, yamlContents.length(),
-								new Yaml(YamlGraphDeploymentProperties.createDumperOptions())
+								new Yaml(new SafeConstructor(), new Representer(options), options)
 										.dump(ApplicationManifestHandler.toYaml(deploymentProperties, cloudData)));
 					}
 
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.test/src/org/springframework/ide/eclipse/boot/dash/test/RouteBuilderTest.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.test/src/org/springframework/ide/eclipse/boot/dash/test/RouteBuilderTest.java
@@ -31,8 +31,8 @@
 import org.springframework.ide.eclipse.editor.support.yaml.ast.YamlASTProvider;
 import org.springframework.ide.eclipse.editor.support.yaml.ast.YamlFileAST;
 import org.springframework.ide.eclipse.editor.support.yaml.path.YamlPath;
-import org.springframework.ide.eclipse.editor.support.yaml.path.YamlTraversal;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.nodes.Node;
 
 import com.google.common.collect.ImmutableList;
@@ -293,7 +293,7 @@ private void assertRoutes(List<CFCloudDomain> domains, String manifestText, Stri
 	 */
 	private RouteAttributes parse(List<CFCloudDomain> domains, String manifestText) {
 		IDocument doc = new Document(manifestText);
-		YamlASTProvider parser = new YamlASTProvider(new Yaml());
+		YamlASTProvider parser = new YamlASTProvider(new Yaml(new SafeConstructor()));
 		YamlFileAST ast = parser.getAST(doc);
 		List<Node> names = YamlPath.EMPTY
 				.thenAnyChild()
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.test/src/org/springframework/ide/eclipse/boot/dash/test/yaml/AppNameReconcilerTest.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.test/src/org/springframework/ide/eclipse/boot/dash/test/yaml/AppNameReconcilerTest.java
@@ -24,6 +24,7 @@
 import org.springframework.ide.eclipse.boot.dash.cf.deployment.AppNameReconciler;
 import org.springframework.ide.eclipse.editor.support.yaml.ast.YamlASTProvider;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 /**
  * Tests for application name reconciler
@@ -34,7 +35,7 @@
 public class AppNameReconcilerTest {
 
 	private void testAppNames(String manifest, String...expectedAppNames) throws Exception {
-		AppNameReconciler reconciler = new AppNameReconciler(new YamlASTProvider(new Yaml()));
+		AppNameReconciler reconciler = new AppNameReconciler(new YamlASTProvider(new Yaml(new SafeConstructor())));
 		AppNameAnnotationModel annotationModel = new AppNameAnnotationModel("test");
 		Document doc = new Document(manifest);
 		reconciler.reconcile(doc, annotationModel, new NullProgressMonitor());
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.test/src/org/springframework/ide/eclipse/boot/dash/test/yaml/DeploymentProperties2YamlTest.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.dash.test/src/org/springframework/ide/eclipse/boot/dash/test/yaml/DeploymentProperties2YamlTest.java
@@ -25,6 +25,8 @@
 import org.yaml.snakeyaml.DumperOptions.FlowStyle;
 import org.yaml.snakeyaml.DumperOptions.LineBreak;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
+import org.yaml.snakeyaml.representer.Representer;
 
 /**
  * Tests for generating YAML files from {@link CloudApplicationDeploymentProperties}
@@ -44,7 +46,7 @@ private static void testDeploymentProperties(CloudApplicationDeploymentPropertie
 		options.setDefaultFlowStyle(FlowStyle.BLOCK);
 		options.setLineBreak(LineBreak.getPlatformLineBreak());
 
-		String generatedManifest = new Yaml(options).dump(map);
+		String generatedManifest = new Yaml(new SafeConstructor(), new Representer(options), options).dump(map);
 
 		File yamlFile = ManifestCompareMergeTests.getTestFile(expectedYamlFilePath);
 		FileInputStream inputStream = null;
diff --git a/eclipse-extensions/org.springframework.ide.eclipse.boot.refactoring/src/org/springframework/ide/eclipse/boot/refactoring/PropertiesToYamlConverter.java b/eclipse-extensions/org.springframework.ide.eclipse.boot.refactoring/src/org/springframework/ide/eclipse/boot/refactoring/PropertiesToYamlConverter.java
@@ -25,6 +25,8 @@
 import org.springframework.ide.eclipse.editor.support.yaml.path.YamlPathSegment.AtIndex;
 import org.yaml.snakeyaml.DumperOptions;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
+import org.yaml.snakeyaml.representer.Representer;
 
 import com.google.common.collect.Multimap;
 
@@ -159,7 +161,7 @@ public PropertiesToYamlConverter(Multimap<String, String> properties) {
 		options.setDefaultFlowStyle(DumperOptions.FlowStyle.BLOCK);
 		options.setPrettyFlow(true);
 
-		Yaml yaml = new Yaml(options);
+		Yaml yaml = new Yaml(new SafeConstructor(), new Representer(options), options);
 		this.output = yaml.dump(object);
 	}
 
diff --git a/eclipse-language-servers/org.springframework.ide.eclipse.editor.support/src/org/springframework/ide/eclipse/editor/support/yaml/AbstractYamlSourceViewerConfiguration.java b/eclipse-language-servers/org.springframework.ide.eclipse.editor.support/src/org/springframework/ide/eclipse/editor/support/yaml/AbstractYamlSourceViewerConfiguration.java
@@ -49,6 +49,7 @@
 import org.springframework.ide.eclipse.editor.support.yaml.hover.YamlHoverInfoProvider;
 import org.springframework.ide.eclipse.editor.support.yaml.structure.YamlStructureProvider;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 /**
  * @author Kris De Volder
@@ -76,7 +77,7 @@ public abstract class AbstractYamlSourceViewerConfiguration extends YEditSourceV
 
 	private Provider<Shell> shellProvider;
 	private final String DIALOG_SETTINGS_KEY = this.getClass().getName();
-	private final YamlASTProvider astProvider = new YamlASTProvider(new Yaml());
+	private final YamlASTProvider astProvider = new YamlASTProvider(new Yaml(new SafeConstructor()));
 	private YamlCompletionEngine completionEngine;
 	protected ForceableReconciler fReconciler;
 
diff --git a/headless-services/commons/commons-yaml/src/main/java/org/springframework/ide/vscode/commons/yaml/ast/YamlParser.java b/headless-services/commons/commons-yaml/src/main/java/org/springframework/ide/vscode/commons/yaml/ast/YamlParser.java
@@ -19,7 +19,9 @@
 import org.yaml.snakeyaml.DumperOptions;
 import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.nodes.Node;
+import org.yaml.snakeyaml.representer.Representer;
 
 import com.google.common.collect.ImmutableList;
 
@@ -36,7 +38,7 @@ public YamlFileAST getAST(IDocument doc) throws Exception {
 		reader.setInput(atTokenTransformHack(doc.get()));
 		LoaderOptions loaderOpts = new LoaderOptions();
 		loaderOpts.setMaxAliasesForCollections(1000);
-		Iterable<Node> nodes = new Yaml(loaderOpts).composeAll(reader);
+		Iterable<Node> nodes = new Yaml(new SafeConstructor(loaderOpts), new Representer(), new DumperOptions(), loaderOpts).composeAll(reader);
 		return new YamlFileAST(doc, ImmutableList.copyOf(nodes));
 	}
 
diff --git a/headless-services/spring-boot-language-server/src/main/java/org/springframework/ide/vscode/boot/app/BootLanguageServerBootApp.java b/headless-services/spring-boot-language-server/src/main/java/org/springframework/ide/vscode/boot/app/BootLanguageServerBootApp.java
@@ -31,7 +31,6 @@
 import org.springframework.boot.autoconfigure.context.ConfigurationPropertiesAutoConfiguration;
 import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
-import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.ide.vscode.boot.common.PropertyCompletionFactory;
@@ -49,8 +48,8 @@
 import org.springframework.ide.vscode.boot.java.livehover.v2.SpringProcessConnectorService;
 import org.springframework.ide.vscode.boot.java.livehover.v2.SpringProcessLiveDataProvider;
 import org.springframework.ide.vscode.boot.java.rewrite.RewriteCompilationUnitCache;
-import org.springframework.ide.vscode.boot.java.rewrite.RewriteRefactorings;
 import org.springframework.ide.vscode.boot.java.rewrite.RewriteRecipeRepository;
+import org.springframework.ide.vscode.boot.java.rewrite.RewriteRefactorings;
 import org.springframework.ide.vscode.boot.java.utils.CompilationUnitCache;
 import org.springframework.ide.vscode.boot.java.utils.SymbolCache;
 import org.springframework.ide.vscode.boot.java.utils.SymbolCacheOnDisc;
@@ -92,6 +91,7 @@
 import org.springframework.ide.vscode.languageserver.starter.LanguageServerAutoConf;
 import org.springframework.ide.vscode.languageserver.starter.LanguageServerRunnerAutoConf;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 import com.google.common.collect.ImmutableList;
 import com.google.gson.Gson;
@@ -269,7 +269,7 @@ SpringProcessConnectorRemote remoteAppsFromCommandsConnector(SimpleLanguageServe
 
 	@Bean Yaml yaml() {
 		//TODO: Yaml is not re-entrant. So its a bit fishy to create a 're-usable' bean for this!
-		return new Yaml();
+		return new Yaml(new SafeConstructor());
 	}
 
 	@Bean YamlASTProvider yamlAstProvider() {
diff --git a/headless-services/spring-boot-language-server/src/main/java/org/springframework/ide/vscode/boot/metadata/AdHocSpringPropertyIndexProvider.java b/headless-services/spring-boot-language-server/src/main/java/org/springframework/ide/vscode/boot/metadata/AdHocSpringPropertyIndexProvider.java
@@ -33,6 +33,7 @@
 import org.springframework.ide.vscode.commons.util.text.LanguageId;
 import org.springframework.ide.vscode.commons.yaml.ast.NodeUtil;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.nodes.MappingNode;
 import org.yaml.snakeyaml.nodes.Node;
 import org.yaml.snakeyaml.nodes.NodeTuple;
@@ -139,7 +140,7 @@ private Properties parseProperties(File propsFile) {
 
 	private Properties parseYaml(File yamlFile) {
 		if (yamlFile.isFile()) {
-			Yaml yaml = new Yaml();
+			Yaml yaml = new Yaml(new SafeConstructor());
 			try (Reader reader = new InputStreamReader(new FileInputStream(yamlFile), "UTF8")) {
 				Properties props = new Properties();
 				for (Node node : yaml.composeAll(reader)) {
