You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ac...@apache.org on 2026/08/03 09:45:15 UTC
(camel) branch main updated: CAMEL-24294: enforce the typeFilters allow-list in the SnakeYAML TagInspector (#25285)
This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new e565db076cf3 CAMEL-24294: enforce the typeFilters allow-list in the SnakeYAML TagInspector (#25285)
e565db076cf3 is described below
commit e565db076cf35070ffa5bfde559b9dab85d4cb6d
Author: Andrea Cosentino <an...@gmail.com>
AuthorDate: Mon Aug 3 11:45:07 2026 +0200
CAMEL-24294: enforce the typeFilters allow-list in the SnakeYAML TagInspector (#25285)
SnakeYAMLDataFormat's TrustedTagInspector.isGlobalTagAllowed() returned true unconditionally, so the
SnakeYAML 2.x TagInspector layer was effectively disabled and the typeFilters allow-list was enforced
only by the getClassForName constructor override. Make the inspector consult the same allowTypeFilter(...)
check so both layers enforce the configured filters.
When typeFilters/unmarshalType is configured, a disallowed global tag is now rejected earlier (during
composing) as a ComposerException, instead of the previous ConstructorException caused by an
IllegalArgumentException from getClassForName. The set of accepted types is unchanged; the security
tests and an upgrade-guide note are updated accordingly. Routes without typeFilters are unaffected.
Co-authored-by: Claude Opus 4.8 <no...@anthropic.com>
---
.../camel/component/snakeyaml/SnakeYAMLDataFormat.java | 4 +++-
.../component/snakeyaml/SnakeYAMLTypeFilterHelper.java | 17 +++++++++--------
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 12 +++++++++++-
3 files changed, 23 insertions(+), 10 deletions(-)
diff --git a/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java b/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
index aca5f5b56164..1f373ce4f7e1 100644
--- a/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
+++ b/components/camel-snakeyaml/src/main/java/org/apache/camel/component/snakeyaml/SnakeYAMLDataFormat.java
@@ -332,7 +332,9 @@ public final class SnakeYAMLDataFormat extends ServiceSupport implements DataFor
final class TrustedTagInspector implements TagInspector {
@Override
public boolean isGlobalTagAllowed(Tag tag) {
- return true;
+ // consult the same typeFilters allow-list as getClassForName, so the SnakeYAML 2.x TagInspector
+ // layer actually enforces the configured filters instead of allowing every global tag (CAMEL-24294)
+ return allowTypeFilter(tag.getClassName());
}
}
}
diff --git a/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java b/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
index cb2b6e4e9c01..9ed02ad158bc 100644
--- a/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
+++ b/components/camel-snakeyaml/src/test/java/org/apache/camel/component/snakeyaml/SnakeYAMLTypeFilterHelper.java
@@ -21,6 +21,7 @@ import org.apache.camel.ProducerTemplate;
import org.apache.camel.component.snakeyaml.model.RexPojo;
import org.apache.camel.component.snakeyaml.model.TestPojo;
import org.apache.camel.component.snakeyaml.model.UnsafePojo;
+import org.yaml.snakeyaml.composer.ComposerException;
import org.yaml.snakeyaml.constructor.ConstructorException;
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
@@ -57,10 +58,11 @@ public final class SnakeYAMLTypeFilterHelper {
"!!org.apache.camel.component.snakeyaml.model.UnsafePojo {name: Camel}"),
"As SnakeYAML filters class is can unmarshall, UnsafePojo should not be allowed");
- // Wrapped by SnakeYAML
- assertTrue(ex.getCause() instanceof ConstructorException);
- // Thrown by SnakeYAMLDataFormat
- assertTrue(ex.getCause().getCause() instanceof IllegalArgumentException);
+ // Rejected by the SnakeYAML TagInspector allow-list during composing (CAMEL-24294), before
+ // getClassForName would run - so the failure is a ComposerException, not the previous
+ // ConstructorException -> IllegalArgumentException chain.
+ assertTrue(ex.getCause() instanceof ComposerException);
+ assertTrue(ex.getCause().getMessage().contains("UnsafePojo"));
}
static void testTypeConstructorFromDefinition(ProducerTemplate template) {
@@ -88,10 +90,9 @@ public final class SnakeYAMLTypeFilterHelper {
"!!org.apache.camel.component.snakeyaml.model.UnsafePojo {name: Camel}"),
"As SnakeYAML filters class is can unmarshall, UnsafePojo should not be allowed");
- // Wrapped by SnakeYAML
- assertTrue(ex.getCause() instanceof ConstructorException);
- // Thrown by SnakeYAMLDataFormat
- assertTrue(ex.getCause().getCause() instanceof IllegalArgumentException);
+ // Rejected by the SnakeYAML TagInspector allow-list during composing (CAMEL-24294)
+ assertTrue(ex.getCause() instanceof ComposerException);
+ assertTrue(ex.getCause().getMessage().contains("UnsafePojo"));
}
static void testAllowAllConstructor(ProducerTemplate template) {
diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index cababaade832..79a5b665050d 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -1529,6 +1529,16 @@ data format and the iterator/splitter modes. The full, unmodified entry name rem
so routes that intentionally recreate the archive's directory structure keep working — read it
from `CamelTarFileEntryName` for tar and from `zipFileName` for zip instead of `CamelFileName`.
+=== camel-snakeyaml - typeFilters are now also enforced by the SnakeYAML TagInspector
+
+When `typeFilters` (or `unmarshalType`) is configured, the allow-list is now also enforced by the
+SnakeYAML 2.x `TagInspector` layer, not only by the `getClassForName` constructor override. A YAML
+document that references a disallowed global tag is therefore rejected earlier, during composing, and
+surfaces as an `org.yaml.snakeyaml.composer.ComposerException` (`"Global tag is not allowed: ..."`)
+instead of the previous `ConstructorException` caused by an `IllegalArgumentException`. The set of
+accepted types is unchanged; only the exception raised for a rejected type differs. Routes that do not
+configure `typeFilters` are unaffected.
+
=== camel-jfr
`camel-jfr` can now also emit JFR events during message routing, in addition to the
@@ -1541,4 +1551,4 @@ read once while the `CamelContext` initializes and cannot be changed afterwards.
`org.apache.camel.spi.StartupStepRecorder` gained the default methods
`isRuntimeEnabled()` and `setRuntimeEnabled(boolean)`. Both have no-op defaults, so
-existing implementations continue to compile and behave as before.
\ No newline at end of file
+existing implementations continue to compile and behave as before.