From e7f55ab8c3bd6bac4c87354afec231d7237c35b8 Mon Sep 17 00:00:00 2001 From: Brandon Williams Date: Thu, 12 Jan 2023 06:50:40 -0600 Subject: [PATCH] switch to SafeConstructor Patch by brandonwilliams; reviewed by bereng for CASSANDRA-18150 --- CHANGES.txt | 1 + .../apache/cassandra/config/YamlConfigurationLoader.java | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 16d6bb41ac..aec4a679f1 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,5 @@ 3.0.29 + * Switch to snakeyaml's SafeConstructor (CASSANDRA-18150) * Expand build.dir property in rat targets (CASSANDRA-18183) * Suppress CVE-2022-41881 (CASSANDRA-18148) * Default role is created with zero timestamp (CASSANDRA-12525) diff --git a/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java b/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java index d2563b82e6..8376300520 100644 --- a/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java +++ b/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java @@ -39,7 +39,7 @@ import org.apache.cassandra.exceptions.ConfigurationException; import org.yaml.snakeyaml.TypeDescription; import org.yaml.snakeyaml.Yaml; import org.yaml.snakeyaml.composer.Composer; -import org.yaml.snakeyaml.constructor.Constructor; +import org.yaml.snakeyaml.constructor.SafeConstructor; import org.yaml.snakeyaml.constructor.CustomClassLoaderConstructor; import org.yaml.snakeyaml.error.YAMLException; import org.yaml.snakeyaml.introspector.MissingProperty; @@ -114,7 +114,7 @@ public class YamlConfigurationLoader implements ConfigurationLoader throw new AssertionError(e); } - Constructor constructor = new CustomConstructor(Config.class); + SafeConstructor constructor = new CustomConstructor(Config.class); MissingPropertiesChecker propertiesChecker = new MissingPropertiesChecker(); constructor.setPropertyUtils(propertiesChecker); Yaml yaml = new Yaml(constructor); @@ -136,7 +136,7 @@ public class YamlConfigurationLoader implements ConfigurationLoader @SuppressWarnings("unchecked") //getSingleData returns Object, not T public static T fromMap(Map map, boolean shouldCheck, Class klass) { - Constructor constructor = new YamlConfigurationLoader.CustomConstructor(klass, klass.getClassLoader()); + SafeConstructor constructor = new YamlConfigurationLoader.CustomConstructor(klass, klass.getClassLoader()); YamlConfigurationLoader.MissingPropertiesChecker propertiesChecker = new YamlConfigurationLoader.MissingPropertiesChecker(); constructor.setPropertyUtils(propertiesChecker); Yaml yaml = new Yaml(constructor);