Merge pull request #1676 from brendandburns/yaml

Update the CustomConstructor class for SnakeYAML.

Author: k8s-ci-robot

util/src/main/java/io/kubernetes/client/util/Yaml.java

@@ -34,6 +34,7 @@
 import org.slf4j.LoggerFactory;
 import org.yaml.snakeyaml.DumperOptions;
 import org.yaml.snakeyaml.constructor.Constructor;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 import org.yaml.snakeyaml.introspector.Property;
 import org.yaml.snakeyaml.nodes.MappingNode;
 import org.yaml.snakeyaml.nodes.Node;
@@ -78,7 +79,7 @@ public static Object load(File f) throws IOException {
    * @throws IOException If an error occurs while reading the YAML.
    */
   public static Object load(Reader reader) throws IOException {
-    Map<String, Object> data = getSnakeYaml().load(reader);
+    Map<String, Object> data = getSnakeYaml(null).load(reader);
     return modelMapper(data);
   }
 
@@ -92,7 +93,7 @@ public static Object load(Reader reader) throws IOException {
    * @throws IOException If an error occurs while reading the YAML.
    */
   public static <T> T loadAs(String content, Class<T> clazz) {
-    return getSnakeYaml().loadAs(new StringReader(content), clazz);
+    return getSnakeYaml(clazz).loadAs(new StringReader(content), clazz);
   }
 
   /**
@@ -104,7 +105,7 @@ public static <T> T loadAs(String content, Class<T> clazz) {
    * @throws IOException If an error occurs while reading the YAML.
    */
   public static <T> T loadAs(File f, Class<T> clazz) throws IOException {
-    return getSnakeYaml().loadAs(new FileReader(f), clazz);
+    return getSnakeYaml(clazz).loadAs(new FileReader(f), clazz);
   }
 
   /**
@@ -117,7 +118,7 @@ public static <T> T loadAs(File f, Class<T> clazz) throws IOException {
    * @throws IOException If an error occurs while reading the YAML.
    */
   public static <T> T loadAs(Reader reader, Class<T> clazz) {
-    return getSnakeYaml().loadAs(reader, clazz);
+    return getSnakeYaml(clazz).loadAs(reader, clazz);
   }
 
   /**
@@ -160,7 +161,7 @@ public static List<Object> loadAll(File f) throws IOException {
    * @throws IOException If an error occurs while reading the YAML.
    */
   public static List<Object> loadAll(Reader reader) throws IOException {
-    Iterable<Object> iterable = getSnakeYaml().loadAll(reader);
+    Iterable<Object> iterable = getSnakeYaml(null).loadAll(reader);
     List<Object> list = new ArrayList<Object>();
     for (Object object : iterable) {
       if (object != null) {
@@ -182,7 +183,7 @@ public static List<Object> loadAll(Reader reader) throws IOException {
    * @return A YAML String representing the API object.
    */
   public static String dump(Object object) {
-    return getSnakeYaml().dump(object);
+    return getSnakeYaml(object.getClass()).dump(object);
   }
 
   /**
@@ -192,7 +193,7 @@ public static String dump(Object object) {
    * @param writer The writer to write the YAML to.
    */
   public static void dump(Object object, Writer writer) {
-    getSnakeYaml().dump(object, writer);
+    getSnakeYaml(object.getClass()).dump(object, writer);
   }
 
   /**
@@ -202,7 +203,7 @@ public static void dump(Object object, Writer writer) {
    * @return A String representing the list of YAML API objects.
    */
   public static String dumpAll(Iterator<? extends KubernetesType> data) {
-    return getSnakeYaml().dumpAll(data);
+    return getSnakeYaml(null).dumpAll(data);
   }
 
   /**
@@ -212,11 +213,15 @@ public static String dumpAll(Iterator<? extends KubernetesType> data) {
    * @param output The writer to output the YAML String to.
    */
   public static void dumpAll(Iterator<? extends KubernetesType> data, Writer output) {
-    getSnakeYaml().dumpAll(data, output);
+    getSnakeYaml(null).dumpAll(data, output);
   }
 
   /** Defines constructor logic for custom types in this library. */
   public static class CustomConstructor extends Constructor {
+    public CustomConstructor(Class<?> type) {
+      super(type);
+    }
+
     @Override
     protected Object constructObject(Node node) {
       if (node.getType() == IntOrString.class) {
@@ -225,11 +230,9 @@ protected Object constructObject(Node node) {
       if (node.getType() == byte[].class) {
         return constructByteArray((ScalarNode) node);
       }
-
       if (node.getType() == OffsetDateTime.class) {
         return constructDateTime((ScalarNode) node);
       }
-
       return super.constructObject(node);
     }
 
@@ -357,8 +360,16 @@ protected NodeTuple representJavaBeanProperty(
   }
 
   /** @return An instantiated SnakeYaml Object. */
+  @Deprecated
   public static org.yaml.snakeyaml.Yaml getSnakeYaml() {
-    return new org.yaml.snakeyaml.Yaml(new CustomConstructor(), new CustomRepresenter());
+    return getSnakeYaml(null);
+  }
+
+  private static org.yaml.snakeyaml.Yaml getSnakeYaml(Class<?> type) {
+    if (type != null) {
+      return new org.yaml.snakeyaml.Yaml(new CustomConstructor(type), new CustomRepresenter());
+    }
+    return new org.yaml.snakeyaml.Yaml(new SafeConstructor(), new CustomRepresenter());
   }
 
   /**
@@ -381,7 +392,7 @@ private static Object modelMapper(Map<String, Object> data) throws IOException {
       throw new IOException(
           "Unknown apiVersionKind " + apiVersion + "/" + kind + " is it registered?");
     }
-    return loadAs(new StringReader(getSnakeYaml().dump(data)), clazz);
+    return loadAs(new StringReader(getSnakeYaml(clazz).dump(data)), clazz);
   }
 
   @Deprecated

util/src/test/java/io/kubernetes/client/util/TestPoJ.java

@@ -0,0 +1,25 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+package io.kubernetes.client.util;
+
+public class TestPoJ {
+  private static boolean marker = false;
+
+  public TestPoJ() {
+    marker = true;
+  }
+
+  public static boolean hasBeenConstructed() {
+    return marker;
+  }
+}

util/src/test/java/io/kubernetes/client/util/YamlTest.java

@@ -47,6 +47,8 @@ public class YamlTest {
 
   private static final URL CREATED_TIMESTAMP_FILE = Resources.getResource("test-pod.yaml");
 
+  private static final URL TAGGED_FILE = Resources.getResource("pod-tag.yaml");
+
   private static final String[] kinds =
       new String[] {
         "Pod",
@@ -256,4 +258,26 @@ public void testDateTimeRoundTrip() {
       assertNull("Unexpected exception: " + ex.toString(), ex);
     }
   }
+
+  @Test
+  public void testYamlCantConstructObjects() {
+    try {
+      String data = Resources.toString(TAGGED_FILE, UTF_8);
+      Object pod = Yaml.load(data);
+    } catch (Exception ex) {
+      // pass
+    }
+    assertFalse("Object should not be constructed!", TestPoJ.hasBeenConstructed());
+  }
+
+  @Test
+  public void testLoadAsYamlCantConstructObjects() {
+    try {
+      String data = Resources.toString(TAGGED_FILE, UTF_8);
+      V1Pod pod = Yaml.loadAs(data, V1Pod.class);
+    } catch (Exception ex) {
+      // pass
+    }
+    assertFalse("Object should not be constructed!", TestPoJ.hasBeenConstructed());
+  }
 }

util/src/test/resources/pod-tag.yaml

@@ -0,0 +1,12 @@
+!!io.kubernetes.client.util.TestPoJ
+apiVersion: v1
+kind: Pod
+metadata:
+  creationTimestamp: "2018-12-23T01:09:18Z"
+  generateName: test-776d6c86cc-
+  labels:
+    app: test
+    app-version: "19911"
+    pod-template-hash: "3328274277"
+  name: test-776d6c86cc-4zwj5
+  namespace: default