Skip to content

Commit 33a0f91

Browse files
NathanSweetNathanSweet
committed
Formatting, clean up.
#164
1 parent b112258 commit 33a0f91

4 files changed

Lines changed: 103 additions & 131 deletions

File tree

‎src/com/esotericsoftware/yamlbeans/SafeYamlConfig.java‎

Lines changed: 37 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,42 @@
1-
package com.esotericsoftware.yamlbeans;
21

2+
package com.esotericsoftware.yamlbeans;
33

4-
/**
5-
* SafeYamlConfig extends YamlConfig and hard codes the read anchor and read class tag flags to false.
6-
* When these flags are enabled, it is possible to perform a deserialization attack if the Yaml being parsed is from an
7-
* untrusted source.
8-
* Using SafeYamlConfig is the equivalent of using YamlConfig after setting
9-
* yamlConfig.readConfig.setAnchors(false);
10-
* yamlConfig.readConfig.setClassTags(false);
11-
*
12-
* It should be noted by setting these two values neither anchors or specifying class names are supported.
13-
* It is still possible to deserialize back to a specific object, but you need to specify the Class type in the code.
14-
* e.g
15-
* SafeYamlConfig yamlConfig = new SafeYamlConfig();
16-
* YamlReader reader = new YamlReader(yamlData.toString(),yamlConfig);
17-
* Data data = reader.read(Data.class);
18-
*
4+
/** SafeYamlConfig extends YamlConfig and hard codes the read anchor and read class tag flags to false. When these flags are
5+
* enabled, it is possible to perform a deserialization attack if the Yaml being parsed is from an untrusted source.
6+
* <p>
7+
* Using SafeYamlConfig is the equivalent of using YamlConfig after setting:
8+
*
9+
* <pre>
10+
* yamlConfig.readConfig.setAnchors(false);
11+
* yamlConfig.readConfig.setClassTags(false);
12+
* </pre>
13+
*
14+
* It should be noted by setting these two values neither anchors or specifying class names are supported. It is still possible to
15+
* deserialize back to a specific object, but you need to specify the Class type in the code. For example:
16+
*
17+
* <pre>
18+
* SafeYamlConfig config = new SafeYamlConfig();
19+
* YamlReader reader = new YamlReader(yamlData.toString(), config);
20+
* Data data = reader.read(Data.class);
21+
* </pre>
1922
*/
2023
public class SafeYamlConfig extends YamlConfig {
21-
22-
23-
public SafeYamlConfig () {
24-
super();
25-
super.readConfig = new SafeReadConfig();
26-
}
27-
28-
static public class SafeReadConfig extends ReadConfig {
29-
30-
public SafeReadConfig(){
31-
super.anchors = false;
32-
super.classTags = false;
33-
}
34-
35-
@Override
36-
public void setClassTags(boolean classTags) {
37-
if(classTags) {
38-
throw new IllegalArgumentException("Class Tags cannot be enabled in SafeYamlConfig.");
39-
}
40-
}
41-
42-
@Override
43-
public void setAnchors(boolean anchors) {
44-
if(anchors) {
45-
throw new IllegalArgumentException("Anchors cannot be enabled in SafeYamlConfig.");
46-
}
47-
}
48-
}
49-
24+
public SafeYamlConfig () {
25+
super.readConfig = new SafeReadConfig();
26+
}
27+
28+
static public class SafeReadConfig extends ReadConfig {
29+
public SafeReadConfig () {
30+
super.anchors = false;
31+
super.classTags = false;
32+
}
33+
34+
public void setClassTags (boolean classTags) {
35+
if (classTags) throw new IllegalArgumentException("Class Tags cannot be enabled in SafeYamlConfig.");
36+
}
37+
38+
public void setAnchors (boolean anchors) {
39+
if (anchors) throw new IllegalArgumentException("Anchors cannot be enabled in SafeYamlConfig.");
40+
}
41+
}
5042
}

‎src/com/esotericsoftware/yamlbeans/YamlConfig.java‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -267,9 +267,6 @@ static public class ReadConfig {
267267
boolean autoMerge = true;
268268
boolean classTags = true;
269269
boolean guessNumberTypes;
270-
271-
272-
273270
boolean anchors = true;
274271

275272
ReadConfig () {
@@ -325,10 +322,10 @@ public void setGuessNumberTypes (boolean guessNumberTypes) {
325322
this.guessNumberTypes = guessNumberTypes;
326323
}
327324

328-
public void setAnchors(boolean anchors) {
325+
/** When false, anchors in the YAML are ignored. Default is true. */
326+
public void setAnchors (boolean anchors) {
329327
this.anchors = anchors;
330328
}
331-
332329
}
333330

334331
static class ConstructorParameters {

‎src/com/esotericsoftware/yamlbeans/YamlReader.java‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,10 @@ public Object get (String alias) {
7878
return anchors.get(alias);
7979
}
8080

81-
private void addAnchor(String key, Object value) {
82-
if(config.readConfig.anchors) {
83-
anchors.put(key, value);
84-
}
81+
private void addAnchor (String key, Object value) {
82+
if (config.readConfig.anchors) anchors.put(key, value);
8583
}
8684

87-
8885
public void close () throws IOException {
8986
parser.close();
9087
anchors.clear();
@@ -164,7 +161,7 @@ protected Object readValue (Class type, Class elementType, Class defaultType)
164161
parser.getNextEvent();
165162
anchor = ((AliasEvent)event).anchor;
166163
Object value = anchors.get(anchor);
167-
if (value == null&&config.readConfig.anchors) throw new YamlReaderException("Unknown anchor: " + anchor);
164+
if (value == null && config.readConfig.anchors) throw new YamlReaderException("Unknown anchor: " + anchor);
168165
return value;
169166
case MAPPING_START:
170167
case SEQUENCE_START:
@@ -244,9 +241,7 @@ private Object readValueInternal (Class type, Class elementType, String anchor)
244241
if (value != null) {
245242
Number number = valueConvertedNumber(value);
246243
if (number != null) {
247-
if (anchor != null) {
248-
addAnchor(anchor, number);
249-
}
244+
if (anchor != null) addAnchor(anchor, number);
250245
parser.getNextEvent();
251246
return number;
252247
}
@@ -291,9 +286,7 @@ private Object readValueInternal (Class type, Class elementType, String anchor)
291286
convertedValue = Byte.decode(value);
292287
} else
293288
throw new YamlException("Unknown field type.");
294-
if (anchor != null) {
295-
addAnchor(anchor, convertedValue);
296-
}
289+
if (anchor != null) addAnchor(anchor, convertedValue);
297290
return convertedValue;
298291
} catch (Exception ex) {
299292
throw new YamlReaderException("Unable to convert value to required type \"" + type + "\": " + value, ex);

‎test/com/esotericsoftware/yamlbeans/SafeYamlConfigTest.java‎

Lines changed: 59 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,69 @@
1+
12
package com.esotericsoftware.yamlbeans;
23

3-
import org.junit.Test;
4+
import static junit.framework.Assert.*;
45

56
import java.util.HashMap;
67
import java.util.List;
78
import java.util.Map;
89

9-
import static junit.framework.Assert.assertEquals;
10-
import static junit.framework.Assert.assertNull;
11-
import static junit.framework.Assert.assertTrue;
10+
import org.junit.Test;
1211

1312
public class SafeYamlConfigTest {
14-
15-
16-
private static final String TESTOBJECT_TAG = "!com.esotericsoftware.yamlbeans.SafeYamlConfigTest$TestObject";
17-
private static final String LINE_SEPARATOR = System.getProperty("line.separator");
18-
19-
20-
@Test
21-
public void testDeserializationOfClassTag() throws YamlException {
22-
SafeYamlConfig yamlConfig = new SafeYamlConfig();
23-
StringBuilder yamlData = new StringBuilder();
24-
yamlData.append(TESTOBJECT_TAG).append(LINE_SEPARATOR)
25-
.append("a: test").append(LINE_SEPARATOR);
26-
YamlReader reader = new YamlReader(yamlData.toString(),yamlConfig);
27-
Object data = reader.read();
28-
assertTrue(data instanceof HashMap);
29-
Map dataMap = (Map) data;
30-
assertTrue(dataMap.containsKey("a"));
31-
assertEquals("test",dataMap.get("a"));
32-
}
33-
34-
35-
36-
@Test
37-
public void testIgnoreAnchor() throws YamlException {
38-
SafeYamlConfig yamlConfig = new SafeYamlConfig();
39-
StringBuilder yamlData = new StringBuilder();
40-
yamlData.append("oldest friend:").append(LINE_SEPARATOR)
41-
.append(" &1 !contact").append(LINE_SEPARATOR)
42-
.append(" name: Bob").append(LINE_SEPARATOR)
43-
.append(" age: 29").append(LINE_SEPARATOR)
44-
.append("best friend: *1").append(LINE_SEPARATOR);
45-
YamlReader reader = new YamlReader(yamlData.toString(),yamlConfig);
46-
Object data = reader.read();
47-
assertTrue(data instanceof HashMap);
48-
Map dataMap = (Map) data;
49-
assertTrue(dataMap.containsKey("oldest friend"));
50-
Map old = (Map) dataMap.get("oldest friend");
51-
assertTrue(old.containsKey("name"));
52-
assertEquals("Bob",old.get("name"));
53-
assertNull(dataMap.get("best friend"));
54-
}
55-
56-
57-
static class TestObject {
58-
private String a;
59-
public int age;
60-
public String name;
61-
public Object object;
62-
public List<Object> objects;
63-
64-
private TestObject() {
65-
}
66-
67-
public TestObject(String a) {
68-
this.a = a;
69-
}
70-
71-
public String getA() {
72-
return a;
73-
}
74-
75-
public void setA(String a) {
76-
this.a = a;
77-
}
78-
}
13+
private static final String TESTOBJECT_TAG = "!com.esotericsoftware.yamlbeans.SafeYamlConfigTest$TestObject";
14+
private static final String LINE_SEPARATOR = System.getProperty("line.separator");
15+
16+
@Test
17+
public void testDeserializationOfClassTag () throws YamlException {
18+
SafeYamlConfig yamlConfig = new SafeYamlConfig();
19+
StringBuilder yamlData = new StringBuilder();
20+
yamlData.append(TESTOBJECT_TAG).append(LINE_SEPARATOR).append("a: test").append(LINE_SEPARATOR);
21+
YamlReader reader = new YamlReader(yamlData.toString(), yamlConfig);
22+
Object data = reader.read();
23+
assertTrue(data instanceof HashMap);
24+
Map dataMap = (Map)data;
25+
assertTrue(dataMap.containsKey("a"));
26+
assertEquals("test", dataMap.get("a"));
27+
}
28+
29+
@Test
30+
public void testIgnoreAnchor () throws YamlException {
31+
SafeYamlConfig yamlConfig = new SafeYamlConfig();
32+
StringBuilder yamlData = new StringBuilder();
33+
yamlData.append("oldest friend:").append(LINE_SEPARATOR).append(" &1 !contact").append(LINE_SEPARATOR)
34+
.append(" name: Bob").append(LINE_SEPARATOR).append(" age: 29").append(LINE_SEPARATOR).append("best friend: *1")
35+
.append(LINE_SEPARATOR);
36+
YamlReader reader = new YamlReader(yamlData.toString(), yamlConfig);
37+
Object data = reader.read();
38+
assertTrue(data instanceof HashMap);
39+
Map dataMap = (Map)data;
40+
assertTrue(dataMap.containsKey("oldest friend"));
41+
Map old = (Map)dataMap.get("oldest friend");
42+
assertTrue(old.containsKey("name"));
43+
assertEquals("Bob", old.get("name"));
44+
assertNull(dataMap.get("best friend"));
45+
}
46+
47+
static class TestObject {
48+
private String a;
49+
public int age;
50+
public String name;
51+
public Object object;
52+
public List<Object> objects;
53+
54+
private TestObject () {
55+
}
56+
57+
public TestObject (String a) {
58+
this.a = a;
59+
}
60+
61+
public String getA () {
62+
return a;
63+
}
64+
65+
public void setA (String a) {
66+
this.a = a;
67+
}
68+
}
7969
}

0 commit comments

Comments
 (0)