Merge pull request #4 from Netcracker/dependabot-branch

Resolves vulnerability CVE-2022-1471
Netcracker · Jan 22, 2025 · eb4aa53 · eb4aa53
2 parents 8c99196 + 6c277a6
commit eb4aa53
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/pom.xml b/pom.xml
@@ -27,7 +27,7 @@ limitations under the License.
     <properties>
         <compiler.version>8</compiler.version>
         <assembly.version>3.3.0</assembly.version>
-        <snakeyaml.version>1.32</snakeyaml.version>
+        <snakeyaml.version>2.0</snakeyaml.version>
         <micrometer.version>1.9.0</micrometer.version>
     </properties>
 

diff --git a/src/main/java/org/qubership/log/generator/Generator.java b/src/main/java/org/qubership/log/generator/Generator.java
@@ -35,6 +35,7 @@
 import io.micrometer.prometheus.PrometheusConfig;
 import io.micrometer.prometheus.PrometheusMeterRegistry;
 import io.micrometer.prometheus.PrometheusRenameFilter;
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.constructor.Constructor;
 
@@ -277,7 +278,8 @@ private static Config getConfig(String path) throws IOException {
         config.setConfig(new ArrayList<>());
         for (String file : files) {
             InputStream inputStream = Files.newInputStream(Paths.get(path + file));
-            Yaml yaml = new Yaml(new Constructor(Config.class));
+            LoaderOptions loaderOptions = new LoaderOptions();
+            Yaml yaml = new Yaml(new Constructor(Config.class, loaderOptions));
             Config fileConfig = yaml.load(inputStream);
             if (fileConfig != null && fileConfig.getConfig() != null && fileConfig.getConfig().size() > 0) {
                 config.getConfig().addAll(fileConfig.getConfig());