Copilot commented on code in PR #4254:
URL:
https://github.com/apache/incubator-kie-kogito-runtimes/pull/4254#discussion_r3091828278
##
kogito-codegen-modules/kogito-codegen-api/src/main/java/org/kie/kogito/codegen/api/context/impl/AbstractKogitoBuildContext.java:
##
@@ -100,11 +103,64 @@ protected static Properties load(File... resourcePaths) {
} catch (IOException ioe) {
LOGGER.debug("Unable to load '" +
APPLICATION_PROPERTIES_FILE_NAME + "'.");
}
+File ymlFile = new File(resourcePath,
APPLICATION_PROPERTIES_YML_FILE_NAME);
+loadYmlProperties(ymlFile, applicationProperties);
+ymlFile = new File(resourcePath,
APPLICATION_PROPERTIES_YAML_FILE_NAME);
+loadYmlProperties(ymlFile, applicationProperties);
}
return applicationProperties;
}
+protected static void loadYmlProperties(File ymlFile, Properties
applicationProperties) {
+Map ymlMap = loadYmlStringMap(ymlFile);
+if (ymlMap != null) {
+applicationProperties.putAll(ymlMap);
+}
+}
+
+protected static Map loadYmlStringMap(File ymlFile) {
+TreeMap ymlMap = loadYmlMap(ymlFile);
+if (ymlMap != null) {
+return convertYamlObjectToMap(ymlMap);
+} else {
+return null;
+}
+}
+
+protected static TreeMap loadYmlMap(File ymlFile) {
+if (ymlFile.exists() && ymlFile.isFile() && ymlFile.canRead()) {
+Yaml yaml = new Yaml();
+try (FileReader yamlFileReader = new FileReader(ymlFile,
StandardCharsets.UTF_8)) {
+return yaml.loadAs(yamlFileReader, TreeMap.class);
Review Comment:
Parsing YAML with `new Yaml()` uses SnakeYAML's default constructor, which
is not the safe mode and can allow type tags / object construction (a known
risk when loading YAML from user-controlled projects during build). Consider
using a `SafeConstructor` with `LoaderOptions` (e.g., restrict tags / aliases /
nesting) so loading `application.yml` cannot trigger unsafe deserialization
paths.
##
kogito-codegen-modules/kogito-codegen-api/src/main/java/org/kie/kogito/codegen/api/context/impl/AbstractKogitoBuildContext.java:
##
@@ -100,11 +103,64 @@ protected static Properties load(File... resourcePaths) {
} catch (IOException ioe) {
LOGGER.debug("Unable to load '" +
APPLICATION_PROPERTIES_FILE_NAME + "'.");
}
+File ymlFile = new File(resourcePath,
APPLICATION_PROPERTIES_YML_FILE_NAME);
+loadYmlProperties(ymlFile, applicationProperties);
+ymlFile = new File(resourcePath,
APPLICATION_PROPERTIES_YAML_FILE_NAME);
+loadYmlProperties(ymlFile, applicationProperties);
}
return applicationProperties;
}
+protected static void loadYmlProperties(File ymlFile, Properties
applicationProperties) {
+Map ymlMap = loadYmlStringMap(ymlFile);
+if (ymlMap != null) {
+applicationProperties.putAll(ymlMap);
+}
+}
+
+protected static Map loadYmlStringMap(File ymlFile) {
+TreeMap ymlMap = loadYmlMap(ymlFile);
+if (ymlMap != null) {
+return convertYamlObjectToMap(ymlMap);
+} else {
+return null;
+}
+}
+
+protected static TreeMap loadYmlMap(File ymlFile) {
+if (ymlFile.exists() && ymlFile.isFile() && ymlFile.canRead()) {
+Yaml yaml = new Yaml();
+try (FileReader yamlFileReader = new FileReader(ymlFile,
StandardCharsets.UTF_8)) {
+return yaml.loadAs(yamlFileReader, TreeMap.class);
+} catch (IOException e) {
+LOGGER.debug("Unable to load '{}'.", ymlFile.getName(), e);
+}
+} else {
+LOGGER.debug("Unable to load '{}'.", ymlFile.getName());
+}
+return null;
+}
+
+protected static Map
convertYamlObjectToMap(TreeMap toConvert) {
+Map toReturn = new HashMap<>();
+convertYamlObjectToMap(toConvert, new StringBuilder(), toReturn);
+return toReturn;
+}
+
+protected static void convertYamlObjectToMap(Map toRead,
StringBuilder builder, Map toPopulate) {
+toRead.forEach((key, value) -> {
+if (value instanceof Map) {
+StringBuilder newBuilder = new StringBuilder(builder);
+convertYamlObjectToMap((Map) value,
newBuilder.append(key).append("."), toPopulate);
+} else {
Review Comment:
`loadYmlMap`/`convertYamlObjectToMap` assume YAML maps always have `String`
keys (`TreeMap` and `Map`). If a YAML file
contains a non-string key (valid YAML), the `forEach((String key, ...))` will
throw a `ClassCastException` at runtime. To make this robust (and remove
unchecked warnings), consider using `Map`/`Map` from
SnakeYAML, and stringify keys via `String.valueOf(key)` during
