oscerd opened a new issue, #139: URL: https://github.com/apache/camel-kit/issues/139
## Description The indexer parses YAML with the default `new Yaml()` constructor in `knowledge/indexer/.../VersionResolver.java` (~line 95) and `knowledge/indexer/.../parser/CveParser.java` (~line 329). SnakeYAML's default `Constructor` permits instantiating arbitrary types via explicit global tags (`!!some.Type`). The indexer runs at **build time** over trusted upstream content (Apache / RH build-of-Camel docs), so this is not an end-user attack surface. Switching to a safe loader is cheap defense-in-depth and documents intent. ## Proposed change Parse with `new Yaml(new SafeConstructor(new LoaderOptions()))` — the data is plain maps/lists and needs no custom types. ## Notes Build-time; defense-in-depth. _AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
