Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating Snakeyaml to v2 has a breaking API #161

Open
wilhaddenIBM opened this issue Mar 13, 2023 · 4 comments
Open

Updating Snakeyaml to v2 has a breaking API #161

wilhaddenIBM opened this issue Mar 13, 2023 · 4 comments

Comments

@wilhaddenIBM
Copy link

In order to resolve CVE-2022-1471 it is necessary to update snakeyaml to at least version 2.0.
Doing this causes this line to fail at runtime as there is no longer a no args constructor for SafeConstructor

final Yaml yamlMapper = new Yaml(new SafeConstructor());

A potential fix is to add an argument to SafeConstructor like

new SafeConstructor(new LoaderOptions())
@vietj
Copy link
Contributor

vietj commented Mar 13, 2023

we are aware of this and created an issue to update to snakeyaml 2.0 vert-x3/issues#617

@vietj vietj added this to the 4.4.1 milestone Mar 13, 2023
@wilhaddenIBM
Copy link
Author

Thanks Julien, do you want me to close this?

@vietj vietj modified the milestones: 4.4.1, 4.4.2 Mar 31, 2023
@vietj
Copy link
Contributor

vietj commented May 2, 2023

solved as a snakeyml 2.0 update

@vietj vietj removed this from the 4.4.2 milestone May 2, 2023
@wilhaddenIBM
Copy link
Author

As per Julien's comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants