Use SafeConstructor

Netcentric · Mar 17, 2023 · dcc0d86 · dcc0d86
1 parent 6897604
commit dcc0d86
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/...etcentric/cq/tools/actool/configreader/YamlConfigurationAdminPluginScalarConstructor.java b/...etcentric/cq/tools/actool/configreader/YamlConfigurationAdminPluginScalarConstructor.java
@@ -8,7 +8,7 @@
 import org.slf4j.LoggerFactory;
 import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.constructor.AbstractConstruct;
-import org.yaml.snakeyaml.constructor.Constructor;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.env.EnvScalarConstructor;
 import org.yaml.snakeyaml.error.YAMLException;
 import org.yaml.snakeyaml.nodes.Node;
@@ -27,7 +27,7 @@
  * @see <a href="https://bitbucket.org/snakeyaml/snakeyaml/wiki/Variable%20substitution">Variable substitution</a>
  *
  */
-public class YamlConfigurationAdminPluginScalarConstructor extends Constructor {
+public class YamlConfigurationAdminPluginScalarConstructor extends SafeConstructor {
 
     // this tag is not used explicitly in YAML but bound implicitly via Yaml.addImplicitResolver(...)
     public static final Tag TAG = new Tag("!CONFIGADMIN");

diff --git a/...le/src/main/java/biz/netcentric/cq/tools/actool/configreader/YamlConfigurationMerger.java b/...le/src/main/java/biz/netcentric/cq/tools/actool/configreader/YamlConfigurationMerger.java
@@ -31,7 +31,10 @@
 import org.osgi.service.component.annotations.ReferencePolicyOption;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.Constructor;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.error.YAMLException;
 
 import biz.netcentric.cq.tools.actool.configmodel.AcConfiguration;
@@ -106,7 +109,7 @@ public AcConfiguration getMergedConfigurations(
             yamlParser.addImplicitResolver(YamlConfigurationAdminPluginScalarConstructor.TAG, CONFIG_ADMIN_INTERPOLATOR_FORMAT, null);
             installLog.addMessage(LOG, "Using YAML parser with ConfigurationAdmin Plugin placeholder support");
         } else {
-            yamlParser = new Yaml();
+            yamlParser = new Yaml(new SafeConstructor(new LoaderOptions()));
         }
         final ConfigurationsValidator configurationsValidator = new YamlConfigurationsValidator();