From 5197004d083fdc44112856e871afe6c4e61ba7a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=90=B4=E6=99=9F=20Wu=20Sheng?= Date: Fri, 6 Nov 2020 10:38:08 +0800 Subject: [PATCH] Fix CVE in the endpoint grouping, when activating the dynamic configuration feature. (#5801) --- CHANGES.md | 1 + .../core/config/group/EndpointGroupingRuleReader.java | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 008355af9..4c771e479 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -31,6 +31,7 @@ Release Notes. * Fix storage-jdbc isExists not set dbname. * Fix `searchService` bug in the InfluxDB storage implementation. * Fix CVE in the alarm module, when activating the dynamic configuration feature. +* Fix CVE in the endpoint grouping, when activating the dynamic configuration feature. * Make the codes and doc consistent in sharding server and core server. #### UI diff --git a/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/config/group/EndpointGroupingRuleReader.java b/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/config/group/EndpointGroupingRuleReader.java index 6bad22ea5..c0d472d6a 100644 --- a/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/config/group/EndpointGroupingRuleReader.java +++ b/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/config/group/EndpointGroupingRuleReader.java @@ -25,6 +25,7 @@ import java.util.Map; import java.util.Objects; import org.apache.skywalking.apm.util.StringUtil; import org.yaml.snakeyaml.Yaml; +import org.yaml.snakeyaml.constructor.SafeConstructor; /** * Read the input stream including the default endpoint grouping rules. And trans @@ -33,13 +34,13 @@ public class EndpointGroupingRuleReader { private Map yamlData; public EndpointGroupingRuleReader(InputStream inputStream) { - Yaml yaml = new Yaml(); - yamlData = yaml.loadAs(inputStream, Map.class); + Yaml yaml = new Yaml(new SafeConstructor()); + yamlData = (Map) yaml.load(inputStream); } public EndpointGroupingRuleReader(Reader io) { - Yaml yaml = new Yaml(); - yamlData = yaml.loadAs(io, Map.class); + Yaml yaml = new Yaml(new SafeConstructor()); + yamlData = (Map) yaml.load(io); } /**