trafficcue/planetiler-openmaptiles
1
0
Fork 0
mirror of https://github.com/cfpwastaken/planetiler-openmaptiles.git synced 2026-02-04 12:31:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use snakeyaml safe constructor (#68)

Browse Source
This commit is contained in:
Michael Barry
2023-02-05 14:22:57 -05:00
committed by GitHub
parent 91f0c29ce5
commit bc44c80efa
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/main/java/org/openmaptiles/Generate.java
View File

@@ -34,8 +34,11 @@ import org.commonmark.parser.Parser;
import org.commonmark.renderer.html.HtmlRenderer; import org.commonmark.renderer.html.HtmlRenderer;
import org.slf4j.Logger; import org.slf4j.Logger;
import org.slf4j.LoggerFactory; import org.slf4j.LoggerFactory;
import org.yaml.snakeyaml.DumperOptions;
import org.yaml.snakeyaml.LoaderOptions; import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.Yaml; import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.SafeConstructor;
import org.yaml.snakeyaml.representer.Representer;
/** /**
* Generates code in the {@code generated} package from the OpenMapTiles schema crawled from a tag or branch in the * Generates code in the {@code generated} package from the OpenMapTiles schema crawled from a tag or branch in the
@@ -98,10 +101,12 @@ public class Generate {
private static final HtmlRenderer renderer = HtmlRenderer.builder().build(); private static final HtmlRenderer renderer = HtmlRenderer.builder().build();
static { static {
var loadOptions = new LoaderOptions();
// bump the default limit of 50 // bump the default limit of 50
var options = new LoaderOptions(); loadOptions.setMaxAliasesForCollections(1_000);
options.setMaxAliasesForCollections(1_000); var dumpOptions = new DumperOptions();
yaml = new Yaml(options); // SafeConstructor restricts types which can be instantiated during deserialization (CVE-2022-1471)
yaml = new Yaml(new SafeConstructor(loadOptions), new Representer(dumpOptions), dumpOptions, loadOptions);
} }
private static <T> T loadAndParseYaml(String url, PlanetilerConfig config, Class<T> clazz) throws IOException { private static <T> T loadAndParseYaml(String url, PlanetilerConfig config, Class<T> clazz) throws IOException {

1
submodule.pom.xml
View File

@@ -23,6 +23,7 @@
<dependency> <dependency>
<groupId>org.yaml</groupId> <groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId> <artifactId>snakeyaml</artifactId>
<version>1.33</version>
</dependency> </dependency>
<dependency> <dependency>
<groupId>org.commonmark</groupId> <groupId>org.commonmark</groupId>