fix(core): use snakeyaml's SafeConstructor (spinnaker#2906)

spinnakerbot · Aug 24, 2018 · 5553109 · 5553109
1 parent aa784dd
commit 5553109
Show file tree

Hide file tree

Showing 8 changed files with 23 additions and 9 deletions.
diff --git a/...acts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/ArtifactConfiguration.java b/...acts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/ArtifactConfiguration.java
@@ -29,6 +29,8 @@
 import org.springframework.context.annotation.Import;
 import org.springframework.scheduling.annotation.EnableScheduling;
 import org.springframework.stereotype.Component;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 @Configuration
 @EnableConfigurationProperties
@@ -47,4 +49,9 @@ public class ArtifactConfiguration {
   ArtifactCredentialsRepository artifactCredentialsRepository() {
     return new ArtifactCredentialsRepository();
   }
+
+  @Bean
+  Yaml yaml() {
+    return new Yaml(new SafeConstructor());
+  }
 }
diff --git a/...tifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/ArtifactDownloader.java b/...tifacts/src/main/java/com/netflix/spinnaker/clouddriver/artifacts/ArtifactDownloader.java
@@ -24,6 +24,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -34,13 +35,13 @@ public class ArtifactDownloader {
 
   final private ObjectMapper objectMapper;
 
-  final Yaml yamlParser;
+  final private Yaml yamlParser;
 
   @Autowired
-  public ArtifactDownloader(ArtifactCredentialsRepository artifactCredentialsRepository, ObjectMapper objectMapper) {
+  public ArtifactDownloader(ArtifactCredentialsRepository artifactCredentialsRepository, ObjectMapper objectMapper, Yaml yaml) {
     this.artifactCredentialsRepository = artifactCredentialsRepository;
     this.objectMapper = objectMapper;
-    this.yamlParser = new Yaml();
+    this.yamlParser = yaml;
   }
 
   public InputStream download(Artifact artifact) throws IOException {

diff --git a/...oovy/com/netflix/spinnaker/clouddriver/kubernetes/v2/artifact/ArtifactReplacerSpec.groovy b/...oovy/com/netflix/spinnaker/clouddriver/kubernetes/v2/artifact/ArtifactReplacerSpec.groovy
@@ -4,13 +4,14 @@ import com.fasterxml.jackson.databind.ObjectMapper
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesManifest
 import com.netflix.spinnaker.kork.artifacts.model.Artifact
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import spock.lang.Specification
 import spock.lang.Unroll
 
 
 class ArtifactReplacerSpec extends Specification {
   def objectMapper = new ObjectMapper()
-  def yaml = new Yaml()
+  def yaml = new Yaml(new SafeConstructor())
 
   KubernetesManifest stringToManifest(String input) {
     return objectMapper.convertValue(yaml.load(input), KubernetesManifest)

diff --git a/...x/spinnaker/clouddriver/kubernetes/v2/caching/agent/KubernetesCacheDataConvertSpec.groovy b/...x/spinnaker/clouddriver/kubernetes/v2/caching/agent/KubernetesCacheDataConvertSpec.groovy
@@ -33,12 +33,13 @@ import com.netflix.spinnaker.kork.artifacts.model.Artifact
 import com.netflix.spinnaker.moniker.Moniker
 import org.apache.commons.lang3.tuple.Pair
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import spock.lang.Specification
 import spock.lang.Unroll
 
 class KubernetesCacheDataConvertSpec extends Specification {
   def mapper = new ObjectMapper()
-  def yaml = new Yaml()
+  def yaml = new Yaml(new SafeConstructor())
   def ACCOUNT = "my-account"
   def NAMESPACE = "spinnaker"
 

diff --git a/...com/netflix/spinnaker/clouddriver/kubernetes/v2/description/KubernetesManifestSpec.groovy b/...com/netflix/spinnaker/clouddriver/kubernetes/v2/description/KubernetesManifestSpec.groovy
@@ -22,12 +22,13 @@ import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.Kube
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesKind
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesManifest
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import spock.lang.Specification
 import spock.lang.Unroll
 
 class KubernetesManifestSpec extends Specification {
   def objectMapper = new ObjectMapper()
-  def yaml = new Yaml()
+  def yaml = new Yaml(new SafeConstructor())
 
   def NAME = "my-name"
   def NAMESPACE = "my-namespace"

diff --git a/...tflix/spinnaker/clouddriver/kubernetes/v2/op/KubernetesDeployManifestOperationSpec.groovy b/...tflix/spinnaker/clouddriver/kubernetes/v2/op/KubernetesDeployManifestOperationSpec.groovy
@@ -38,11 +38,12 @@ import com.netflix.spinnaker.clouddriver.names.NamerRegistry
 import com.netflix.spinnaker.kork.artifacts.model.Artifact
 import com.netflix.spinnaker.moniker.Moniker
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import spock.lang.Specification
 
 class KubernetesDeployManifestOperationSpec extends Specification {
   def objectMapper = new ObjectMapper()
-  def yaml = new Yaml()
+  def yaml = new Yaml(new SafeConstructor())
 
   def ACCOUNT = "account"
   def NAME = "my-name"

diff --git a/...lix/spinnaker/clouddriver/kubernetes/v2/op/handler/KubernetesDeploymentHandlerSpec.groovy b/...lix/spinnaker/clouddriver/kubernetes/v2/op/handler/KubernetesDeploymentHandlerSpec.groovy
@@ -22,11 +22,12 @@ import com.netflix.spinnaker.clouddriver.kubernetes.v2.artifact.ArtifactTypes
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesManifest
 import com.netflix.spinnaker.kork.artifacts.model.Artifact
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import spock.lang.Specification
 
 class KubernetesDeploymentHandlerSpec extends Specification {
   def objectMapper = new ObjectMapper()
-  def yaml = new Yaml()
+  def yaml = new Yaml(new SafeConstructor())
   def handler = new KubernetesDeploymentHandler()
 
   def IMAGE = "gcr.io/project/image"

diff --git a/.../clouddriver/kubernetes/v2/op/handler/KubernetesHorizontalPodAutoscalerHandlerSpec.groovy b/.../clouddriver/kubernetes/v2/op/handler/KubernetesHorizontalPodAutoscalerHandlerSpec.groovy
@@ -22,13 +22,14 @@ import com.netflix.spinnaker.clouddriver.kubernetes.v2.artifact.ArtifactTypes
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesManifest
 import com.netflix.spinnaker.kork.artifacts.model.Artifact
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import spock.lang.Shared
 import spock.lang.Specification
 import spock.lang.Unroll
 
 class KubernetesHorizontalPodAutoscalerHandlerSpec extends Specification {
   def objectMapper = new ObjectMapper()
-  def yaml = new Yaml()
+  def yaml = new Yaml(new SafeConstructor())
   def handler = new KubernetesHorizontalPodAutoscalerHandler()
   def ACCOUNT = "my-account"
   @Shared