test and solution to sercurity issue

modules/swagger-parser/src/main/java/io/swagger/parser/Swagger20Parser.java

@@ -60,10 +60,13 @@ public SwaggerDeserializationResult readWithInfo(String location, List<Authoriza
             if (data.trim().startsWith("{")) {
                 ObjectMapper mapper = Json.mapper();
                 rootNode = mapper.readTree(data);
-            } else {
+            }else {
                 rootNode = DeserializationUtils.readYamlTree(data);
             }
+
             return readWithInfo(rootNode);
+
+
         }
         catch (SSLHandshakeException e) {
             SwaggerDeserializationResult output = new SwaggerDeserializationResult();
@@ -118,9 +121,10 @@ private Swagger convertToSwagger(String data) throws IOException {
                 ObjectMapper mapper = Json.mapper();
                 rootNode = mapper.readTree(data);
             } else {
-                rootNode = DeserializationUtils.readYamlTree(data);
+                    rootNode = DeserializationUtils.readYamlTree(data);
             }
 
+
             if (System.getProperty("debugParser") != null) {
                 LOGGER.info("\n\nSwagger Tree: \n"
                     + ReflectionToStringBuilder.toString(rootNode, ToStringStyle.MULTI_LINE_STYLE) + "\n\n");

modules/swagger-parser/src/main/java/io/swagger/parser/util/DeserializationUtils.java

@@ -10,6 +10,8 @@
 import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 import java.io.IOException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * Created by russellb337 on 7/14/15.
@@ -62,12 +64,20 @@ private static boolean isJson(String contents) {
     }
 
     public static JsonNode readYamlTree(String contents) {
+        String pattern = "[>|&!%`@,.*]";
+        Pattern r = Pattern.compile(pattern);
+        Matcher m = r.matcher(contents);
         org.yaml.snakeyaml.Yaml yaml = new org.yaml.snakeyaml.Yaml(new SafeConstructor());
-        return Json.mapper().convertValue(yaml.load(contents), JsonNode.class);
+        if (!m.lookingAt()) {
+            return Json.mapper().convertValue(yaml.load(contents), JsonNode.class);
+
+        }
+        return null;
     }
 
     public static <T> T readYamlValue(String contents, Class<T> expectedType) {
         org.yaml.snakeyaml.Yaml yaml = new org.yaml.snakeyaml.Yaml(new SafeConstructor());
         return Json.mapper().convertValue(yaml.load(contents), expectedType);
+
     }
 }

modules/swagger-parser/src/main/java/io/swagger/parser/util/SwaggerDeserializer.java

@@ -35,19 +35,20 @@ public class SwaggerDeserializer {
     private final Set<String> operationIDs = new HashSet<>();
 
     public SwaggerDeserializationResult deserialize(JsonNode rootNode) {
+
         SwaggerDeserializationResult result = new SwaggerDeserializationResult();
         ParseResult rootParse = new ParseResult();
-
         Swagger swagger = parseRoot(rootNode, rootParse);
         result.setSwagger(swagger);
         result.setMessages(rootParse.getMessages());
+
         return result;
     }
 
     public Swagger parseRoot(JsonNode node, ParseResult result) {
         String location = "";
         Swagger swagger = new Swagger();
-        if (node.getNodeType().equals(JsonNodeType.OBJECT)) {
+        if (node != null && node.getNodeType().equals(JsonNodeType.OBJECT)) {
             ObjectNode on = (ObjectNode)node;
             Iterator<JsonNode> it = null;
 

modules/swagger-parser/src/test/java/io/swagger/parser/SwaggerParserTest.java

@@ -57,6 +57,13 @@
 
 public class SwaggerParserTest {
 
+    @Test
+    public void testIssueSecurity() {
+        Swagger swagger = new SwaggerParser().read("malicious.yaml");
+        assertNull(swagger);
+    }
+
+
     @Test
     public void testIssueRelativeRefs2(){
         String location = "exampleSpecs/specs/my-domain/test-api/v1/test-api-swagger_v1.json";