[
https://issues.apache.org/jira/browse/CAMEL-24294?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24294:
-------------------------------------
Fix Version/s: 4.22.0
> camel-snakeyaml: align TrustedTagInspector with the typeFilters allow-list
> --------------------------------------------------------------------------
>
> Key: CAMEL-24294
> URL: https://issues.apache.org/jira/browse/CAMEL-24294
> Project: Camel
> Issue Type: Improvement
> Components: camel-snakeyaml
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.22.0
>
>
> SnakeYAMLDataFormat's TrustedTagInspector.isGlobalTagAllowed() returns true
> unconditionally, so the SnakeYAML 2.x TagInspector layer is effectively
> disabled; the sole remaining gate is the getClassForName override. For
> consistency with the existing typeFilters allow-list (used by
> getClassForName), make the inspector consult the same allow-list -
> allowTypeFilter(tag.getClassName()) - instead of returning true (change the
> anonymous static inner class to a member class sharing allowTypeFilter()).
> Only reachable when unmarshalType/typeFilters are configured (non-default).
> Additionally, allowTypeFilter() currently uses PatternHelper regex matching,
> which is broad for a class-name allow-list; consider exact/startsWith
> matching or documenting the regex behaviour.
> _Filed by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
