Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(YamlParser): add SafeConstructor to enforce security #1469

Merged
merged 1 commit into from
Mar 1, 2024
Merged

feat(YamlParser): add SafeConstructor to enforce security #1469

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions framework/src/play/deps/YamlParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@
import org.apache.ivy.plugins.repository.Resource;
import org.apache.ivy.plugins.repository.url.URLResource;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.SafeConstructor;
import org.yaml.snakeyaml.LoaderOptions;

import play.Logger;
import play.Play;
Expand All @@ -53,15 +55,13 @@ public boolean accept(Resource rsrc) {
return rsrc.exists() && rsrc.getName().endsWith(".yml");
}



@Override
public ModuleDescriptor parseDescriptor(ParserSettings ps, URL url, Resource rsrc, boolean bln) throws ParseException, IOException {
try {
InputStream srcStream = rsrc.openStream();
long lastModified = (rsrc != null?rsrc.getLastModified():0L);
Yaml yaml = new Yaml();

Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
Object o = null;

// Try to parse the yaml
Expand Down Expand Up @@ -112,7 +112,7 @@ public ModuleDescriptorParser getParser() {
descriptor.setLastModified(lastModified);

boolean transitiveDependencies = get(data, "transitiveDependencies", boolean.class, true);

List<String> confs = new ArrayList<>();
if (data.containsKey("configurations")) {
if (data.get("configurations") instanceof List) {
Expand All @@ -121,7 +121,7 @@ public ModuleDescriptorParser getParser() {
for (Object conf : configurations) {
String confName;
Map options;

if (conf instanceof String) {
confName = ((String) conf).trim();
options = new HashMap();
Expand All @@ -135,7 +135,7 @@ public ModuleDescriptorParser getParser() {
allExcludes &= exclude;
confs.add((exclude ? "!" : "") + confName);
}

if (allExcludes) {
confs.add(0, "*");
}
Expand All @@ -145,7 +145,7 @@ public ModuleDescriptorParser getParser() {
} else {
confs.add("*");
}

if (data.containsKey("require")) {
if (data.get("require") instanceof List) {

Expand Down Expand Up @@ -304,7 +304,7 @@ public static Set<String> getOrderedModuleList(File file) throws ParseException,
System.setProperty("application.path", Play.applicationPath.getAbsolutePath());
return getOrderedModuleList(modules, file);
}

private static Set<String> getOrderedModuleList(Set<String> modules, File file) throws ParseException, IOException {
if (file == null || !file.exists()) {
throw new FileNotFoundException("There was a problem to find the file");
Expand All @@ -317,28 +317,28 @@ private static Set<String> getOrderedModuleList(Set<String> modules, File file)
DependencyDescriptor[] rules = md.getDependencies();
File localModules = Play.getFile("modules");
for (DependencyDescriptor dep : rules) {
ModuleRevisionId rev = dep.getDependencyRevisionId();
ModuleRevisionId rev = dep.getDependencyRevisionId();
String moduleName = filterModuleName(rev);

// Check if the module was already load to avoid circular parsing
if (moduleName != null && !modules.contains(moduleName)) {
// Add the given module
modules.add(moduleName);
// Need to load module dependencies of this given module

// Need to load module dependencies of this given module
File module = new File(localModules, moduleName);
if(module != null && module.isDirectory()) {
if(module != null && module.isDirectory()) {
File ivyModule = new File(module, "conf/dependencies.yml");
if(ivyModule != null && ivyModule.exists()) {
getOrderedModuleList(modules, ivyModule);
}
}
} else {
File modulePath = new File(IO.readContentAsString(module).trim());
if (modulePath.exists() && modulePath.isDirectory()) {
File ivyModule = new File(modulePath, "conf/dependencies.yml");
if(ivyModule != null && ivyModule.exists()) {
getOrderedModuleList(modules, ivyModule);
}
}
}
}
} else if(moduleName == null && rev.getRevision().equals("->")){
Expand All @@ -347,8 +347,8 @@ private static Set<String> getOrderedModuleList(Set<String> modules, File file)
}
return modules;
}


private static String filterModuleName(ModuleRevisionId rev) {
if (rev != null && !"play".equals(rev.getName())) {
File moduleDir = new File(Play.applicationPath, "modules");
Expand Down
Loading