kazusa
/
skywalking-java
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE in the endpoint grouping, when activating the dynamic configuration feature. (#5801)

This commit is contained in:
吴晟 Wu Sheng 2020-11-06 10:38:08 +08:00 committed by GitHub
parent 901e8d8423
commit 5197004d08
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.md
View File

@ -31,6 +31,7 @@ Release Notes.
* Fix storage-jdbc isExists not set dbname.
* Fix `searchService` bug in the InfluxDB storage implementation.
* Fix CVE in the alarm module, when activating the dynamic configuration feature.
* Fix CVE in the endpoint grouping, when activating the dynamic configuration feature.
* Make the codes and doc consistent in sharding server and core server.
#### UI

9
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/config/group/EndpointGroupingRuleReader.java
View File

@ -25,6 +25,7 @@ import java.util.Map;
import java.util.Objects;
import org.apache.skywalking.apm.util.StringUtil;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.SafeConstructor;
/**
* Read the input stream including the default endpoint grouping rules. And trans
@ -33,13 +34,13 @@ public class EndpointGroupingRuleReader {
private Map yamlData;
public EndpointGroupingRuleReader(InputStream inputStream) {
Yaml yaml = new Yaml();
yamlData = yaml.loadAs(inputStream, Map.class);
Yaml yaml = new Yaml(new SafeConstructor());
yamlData = (Map) yaml.load(inputStream);
}
public EndpointGroupingRuleReader(Reader io) {
Yaml yaml = new Yaml();
yamlData = yaml.loadAs(io, Map.class);
Yaml yaml = new Yaml(new SafeConstructor());
yamlData = (Map) yaml.load(io);
}
/**