Override maxAliasesForCollections at LoaderOptions #30505
Conversation
| @@ -49,6 +49,7 @@ public ShardingSphereYamlConstructor(final Class<?> rootClass) { | |||
|
|
|||
| private static LoaderOptions createLoaderOptions() { | |||
| LoaderOptions result = new LoaderOptions(); | |||
| result.setMaxAliasesForCollections(Integer.MAX_VALUE); | |||
There was a problem hiding this comment.
Could we add unit test for YamlEngine.unmarshal, when maxAliasesForCollections is not overwritten, it'll throw exception.
There was a problem hiding this comment.
And could we set maxAliasesForCollections value to limited value? e.g. 1000. Since
- It's enough for now.
- Use
Integer.MAX_VALUEmight have vulnerability, see:
There was a problem hiding this comment.
And could we disable anchor and alias in snakeyaml?
There was a problem hiding this comment.
Refer
https://stackoverflow.com/questions/63823021/how-to-auto-edit-yaml-file-containing-anchors-aliases-using-snakeyaml
https://www.spigotmc.org/threads/yaml-anchors-and-aliases-how-to-disable-them.523792/
At latest snakeyaml version, should be no option provided to disable aliases directly
There was a problem hiding this comment.
And could we set
maxAliasesForCollectionsvalue to limited value? e.g.1000. Since
- It's enough for now.
- Use
Integer.MAX_VALUEmight have vulnerability, see:
And LoaderOptions.allowRecursiveKeys maybe could avoid the problem
Default
maxAliasesForCollectionsis 50, if over it, will throworg.yaml.snakeyaml.error.YAMLException: Number of aliases for non-scalar nodes exceeds the specified max=50Changes proposed in this pull request:
Before committing this PR, I'm sure that I have checked the following options:
./mvnw clean install -B -T1C -Dmaven.javadoc.skip -Dmaven.jacoco.skip -e.