oscerd opened a new pull request, #25285: URL: https://github.com/apache/camel/pull/25285
## What `SnakeYAMLDataFormat.TrustedTagInspector.isGlobalTagAllowed()` returned `true` unconditionally, so the SnakeYAML 2.x `TagInspector` layer was effectively disabled — the `typeFilters` allow-list was enforced only by the `getClassForName` constructor override. This makes the inspector consult the same `allowTypeFilter(...)` check, so both layers enforce the configured filters (defence-in-depth + consistency). ## Behaviour Only affects configurations that set `typeFilters` / `unmarshalType` (non-default). The set of accepted types is unchanged. A disallowed global tag is now rejected **earlier** — during composing — surfacing as an `org.yaml.snakeyaml.composer.ComposerException` (`"Global tag is not allowed: ..."`) instead of the previous `ConstructorException` caused by an `IllegalArgumentException` from `getClassForName`. Routes without `typeFilters` are unaffected. ## Tests Updated the rejection assertions in `SnakeYAMLTypeFilterHelper` to expect the `ComposerException` (all 19 camel-snakeyaml tests green). The allowed-type, SafeConstructor, and all-constructor cases are unchanged. Full-reactor `mvn clean install -DskipTests` is green. ## Docs Added an upgrade-guide note documenting the changed exception on the disallowed-type path. ## Backport Applicable to `camel-4.18.x` / `camel-4.14.x` (both carry the no-op inspector). Since this is defence-in-depth (the allow-list is already enforced by `getClassForName` on all branches) with a changed exception surface, the backport is left to reviewer discretion; PRs can follow the merge if wanted. Closes CAMEL-24294. --- _Claude Code on behalf of Andrea Cosentino (@oscerd)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
