Andrea Cosentino created CAMEL-24294:
----------------------------------------
Summary: camel-snakeyaml: align TrustedTagInspector with the
typeFilters allow-list
Key: CAMEL-24294
URL: https://issues.apache.org/jira/browse/CAMEL-24294
Project: Camel
Issue Type: Improvement
Components: camel-snakeyaml
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
SnakeYAMLDataFormat's TrustedTagInspector.isGlobalTagAllowed() returns true
unconditionally, so the SnakeYAML 2.x TagInspector layer is effectively
disabled; the sole remaining gate is the getClassForName override. For
consistency with the existing typeFilters allow-list (used by getClassForName),
make the inspector consult the same allow-list -
allowTypeFilter(tag.getClassName()) - instead of returning true (change the
anonymous static inner class to a member class sharing allowTypeFilter()). Only
reachable when unmarshalType/typeFilters are configured (non-default).
Additionally, allowTypeFilter() currently uses PatternHelper regex matching,
which is broad for a class-name allow-list; consider exact/startsWith matching
or documenting the regex behaviour.
_Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
