This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new e565db076cf3 CAMEL-24294: enforce the typeFilters allow-list in the
SnakeYAML TagInspector (#25285)
e565db076cf3 is described below
commit e565db076cf35070ffa5bfde559b9dab85d4cb6d
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Aug 3 11:45:07 2026 +0200
CAMEL-24294: enforce the typeFilters allow-list in the SnakeYAML
TagInspector (#25285)
SnakeYAMLDataFormat's TrustedTagInspector.isGlobalTagAllowed() returned
true unconditionally, so the
SnakeYAML 2.x TagInspector layer was effectively disabled and the
typeFilters allow-list was enforced
only by the getClassForName constructor override. Make the inspector
consult the same allowTypeFilter(...)
check so both layers enforce the configured filters.
When typeFilters/unmarshalType is configured, a disallowed global tag is
now rejected earlier (during
composing) as a ComposerException, instead of the previous
ConstructorException caused by an
IllegalArgumentException from getClassForName. The set of accepted types is
unchanged; the security
tests and an upgrade-guide note are updated accordingly. Routes without
typeFilters are unaffected.
Co-authored-by: Claude Opus 4.8 <[email protected]>
---
.../camel/component/snakeyaml/SnakeYAMLDataFormat.java | 4 +++-
.../component/snakeyaml/SnakeYAMLTypeFilterHelper.java | 17 +++++++++--------
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 12 +++++++++++-
3 files changed, 23 insertions(+), 10 deletions(-)
diff --git
a/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
b/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
index aca5f5b56164..1f373ce4f7e1 100644
---
a/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
+++
b/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
@@ -332,7 +332,9 @@ public final class SnakeYAMLDataFormat extends
ServiceSupport implements DataFor
final class TrustedTagInspector implements TagInspector {
@Override
public boolean isGlobalTagAllowed(Tag tag) {
- return true;
+ // consult the same typeFilters allow-list as getClassForName, so
the SnakeYAML 2.x TagInspector
+ // layer actually enforces the configured filters instead of
allowing every global tag (CAMEL-24294)
+ return allowTypeFilter(tag.getClassName());
}
}
}
diff --git
a/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
b/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
index cb2b6e4e9c01..9ed02ad158bc 100644
---
a/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
+++
b/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
@@ -21,6 +21,7 @@ import org.apache.camel.ProducerTemplate;
import org.apache.camel.component.snakeyaml.model.RexPojo;
import org.apache.camel.component.snakeyaml.model.TestPojo;
import org.apache.camel.component.snakeyaml.model.UnsafePojo;
+import org.yaml.snakeyaml.composer.ComposerException;
import org.yaml.snakeyaml.constructor.ConstructorException;
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
@@ -57,10 +58,11 @@ public final class SnakeYAMLTypeFilterHelper {
"!!org.apache.camel.component.snakeyaml.model.UnsafePojo {name: Camel}"),
"As SnakeYAML filters class is can unmarshall, UnsafePojo
should not be allowed");
- // Wrapped by SnakeYAML
- assertTrue(ex.getCause() instanceof ConstructorException);
- // Thrown by SnakeYAMLDataFormat
- assertTrue(ex.getCause().getCause() instanceof
IllegalArgumentException);
+ // Rejected by the SnakeYAML TagInspector allow-list during composing
(CAMEL-24294), before
+ // getClassForName would run - so the failure is a ComposerException,
not the previous
+ // ConstructorException -> IllegalArgumentException chain.
+ assertTrue(ex.getCause() instanceof ComposerException);
+ assertTrue(ex.getCause().getMessage().contains("UnsafePojo"));
}
static void testTypeConstructorFromDefinition(ProducerTemplate template) {
@@ -88,10 +90,9 @@ public final class SnakeYAMLTypeFilterHelper {
"!!org.apache.camel.component.snakeyaml.model.UnsafePojo {name: Camel}"),
"As SnakeYAML filters class is can unmarshall, UnsafePojo
should not be allowed");
- // Wrapped by SnakeYAML
- assertTrue(ex.getCause() instanceof ConstructorException);
- // Thrown by SnakeYAMLDataFormat
- assertTrue(ex.getCause().getCause() instanceof
IllegalArgumentException);
+ // Rejected by the SnakeYAML TagInspector allow-list during composing
(CAMEL-24294)
+ assertTrue(ex.getCause() instanceof ComposerException);
+ assertTrue(ex.getCause().getMessage().contains("UnsafePojo"));
}
static void testAllowAllConstructor(ProducerTemplate template) {
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index cababaade832..79a5b665050d 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -1529,6 +1529,16 @@ data format and the iterator/splitter modes. The full,
unmodified entry name rem
so routes that intentionally recreate the archive's directory structure keep
working — read it
from `CamelTarFileEntryName` for tar and from `zipFileName` for zip instead of
`CamelFileName`.
+=== camel-snakeyaml - typeFilters are now also enforced by the SnakeYAML
TagInspector
+
+When `typeFilters` (or `unmarshalType`) is configured, the allow-list is now
also enforced by the
+SnakeYAML 2.x `TagInspector` layer, not only by the `getClassForName`
constructor override. A YAML
+document that references a disallowed global tag is therefore rejected
earlier, during composing, and
+surfaces as an `org.yaml.snakeyaml.composer.ComposerException` (`"Global tag
is not allowed: ..."`)
+instead of the previous `ConstructorException` caused by an
`IllegalArgumentException`. The set of
+accepted types is unchanged; only the exception raised for a rejected type
differs. Routes that do not
+configure `typeFilters` are unaffected.
+
=== camel-jfr
`camel-jfr` can now also emit JFR events during message routing, in addition
to the
@@ -1541,4 +1551,4 @@ read once while the `CamelContext` initializes and cannot
be changed afterwards.
`org.apache.camel.spi.StartupStepRecorder` gained the default methods
`isRuntimeEnabled()` and `setRuntimeEnabled(boolean)`. Both have no-op
defaults, so
-existing implementations continue to compile and behave as before.
\ No newline at end of file
+existing implementations continue to compile and behave as before.
