Pass SafeConstructor

for preventing remote code execution vulnerability https://bitbucket.org/asomov/snakeyaml/wiki/Documentation
jenkinsci · Apr 6, 2020 · 356a7ba · 356a7ba
1 parent a299e13
commit 356a7ba
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/src/main/groovy/org/jenkinsci/plugins/yamlaxis/YamlFileLoader.groovy b/src/main/groovy/org/jenkinsci/plugins/yamlaxis/YamlFileLoader.groovy
@@ -3,6 +3,7 @@ import groovy.transform.TupleConstructor
 import hudson.FilePath
 import hudson.Util
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 
 @TupleConstructor
 class YamlFileLoader extends YamlLoader {
@@ -17,7 +18,7 @@ class YamlFileLoader extends YamlLoader {
             return null
         }
 
-        Yaml yaml = new Yaml()
+        Yaml yaml = new Yaml(new SafeConstructor())
         InputStream input = createFilePath().read()
 
         try{

diff --git a/src/main/groovy/org/jenkinsci/plugins/yamlaxis/YamlTextLoader.groovy b/src/main/groovy/org/jenkinsci/plugins/yamlaxis/YamlTextLoader.groovy
@@ -1,6 +1,7 @@
 package org.jenkinsci.plugins.yamlaxis
 import groovy.transform.TupleConstructor
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 
 @TupleConstructor
 class YamlTextLoader extends YamlLoader {
@@ -10,7 +11,7 @@ class YamlTextLoader extends YamlLoader {
 
     @Override
     Map getContent() {
-        Yaml yaml = new Yaml()
+        Yaml yaml = new Yaml(new SafeConstructor())
         yaml.load(yamlText)
     }
 }