switch to SafeConstructor

Patch by brandonwilliams; reviewed by bereng for CASSANDRA-18150
apache · Jan 24, 2023 · e7f55ab · e7f55ab
1 parent 357c0d5
commit e7f55ab
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/CHANGES.txt b/CHANGES.txt
@@ -1,4 +1,5 @@
 3.0.29
+ * Switch to snakeyaml's SafeConstructor (CASSANDRA-18150)
  * Expand build.dir property in rat targets (CASSANDRA-18183)
  * Suppress CVE-2022-41881 (CASSANDRA-18148)
  * Default role is created with zero timestamp (CASSANDRA-12525)

diff --git a/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java b/src/java/org/apache/cassandra/config/YamlConfigurationLoader.java
@@ -39,7 +39,7 @@
 import org.yaml.snakeyaml.TypeDescription;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.composer.Composer;
-import org.yaml.snakeyaml.constructor.Constructor;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.constructor.CustomClassLoaderConstructor;
 import org.yaml.snakeyaml.error.YAMLException;
 import org.yaml.snakeyaml.introspector.MissingProperty;
@@ -114,7 +114,7 @@ public Config loadConfig(URL url) throws ConfigurationException
                 throw new AssertionError(e);
             }
 
-            Constructor constructor = new CustomConstructor(Config.class);
+            SafeConstructor constructor = new CustomConstructor(Config.class);
             MissingPropertiesChecker propertiesChecker = new MissingPropertiesChecker();
             constructor.setPropertyUtils(propertiesChecker);
             Yaml yaml = new Yaml(constructor);
@@ -136,7 +136,7 @@ public static <T> T fromMap(Map<String,Object> map, Class<T> klass)
     @SuppressWarnings("unchecked") //getSingleData returns Object, not T
     public static <T> T fromMap(Map<String,Object> map, boolean shouldCheck, Class<T> klass)
     {
-        Constructor constructor = new YamlConfigurationLoader.CustomConstructor(klass, klass.getClassLoader());
+        SafeConstructor constructor = new YamlConfigurationLoader.CustomConstructor(klass, klass.getClassLoader());
         YamlConfigurationLoader.MissingPropertiesChecker propertiesChecker = new YamlConfigurationLoader.MissingPropertiesChecker();
         constructor.setPropertyUtils(propertiesChecker);
         Yaml yaml = new Yaml(constructor);