OKTA-466620: use snakeyaml safe constructor to instantiate and load y…

…aml config (#712)

* OKTA-466620: use snakeyaml safe constructor to instantiate and load yaml config

* fixed typo

impl/src/main/java/com/okta/sdk/impl/config/YAMLPropertiesSource.java

@@ -23,6 +23,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -47,8 +48,8 @@ public Map<String, String> getProperties() {
             // check to see if file exists
             if (in != null) { // if we have a yaml file.
                 if (Classes.isAvailable("org.yaml.snakeyaml.Yaml")) {
-                    Yaml yaml = new Yaml();
-                    Map config = yaml.loadAs(in, Map.class);
+                    Yaml yaml = new Yaml(new SafeConstructor());
+                    Map config = yaml.load(in);
                     return getFlattenedMap(config);
                 } else {
                     log.warn("YAML not found in classpath, add 'org.yaml.snakeyaml' to support YAML configuration");

swagger-templates/src/main/java/com/okta/swagger/codegen/AbstractOktaJavaClientCodegen.java

@@ -47,6 +47,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 import java.io.File;
 import java.io.FileInputStream;
@@ -121,7 +122,7 @@ public void preprocessSwagger(Swagger swagger) {
         }
 
         try (Reader reader = new InputStreamReader(new FileInputStream(apiFile), StandardCharsets.UTF_8.toString())) {
-            rawSwaggerConfig = new Yaml().loadAs(reader, Map.class);
+            rawSwaggerConfig = new Yaml(new SafeConstructor()).load(reader);
         } catch (IOException e) {
             throw new IllegalStateException("Failed to parse apiFile: "+ apiFile, e);
         }