kazusa
/
skywalking-java
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE in the Apdex threshold configs, when activating the dynamic configuration feature. (#5811)

This commit is contained in:
吴晟 Wu Sheng 2020-11-09 15:55:56 +08:00 committed by GitHub
parent 756926ad2e
commit 5b84c5ad18
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.md
View File

@ -37,6 +37,7 @@ Release Notes.
* Fix CVE in the alarm module, when activating the dynamic configuration feature.
* Fix CVE in the endpoint grouping, when activating the dynamic configuration feature.
* Fix CVE in the uninstrumented gateways configs, when activating the dynamic configuration feature.
* Fix CVE in the Apdex threshold configs, when activating the dynamic configuration feature.
* Make the codes and doc consistent in sharding server and core server.
#### UI

3
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/analysis/ApdexThresholdConfig.java
View File

@ -30,6 +30,7 @@ import org.apache.skywalking.oap.server.core.CoreModule;
import org.apache.skywalking.oap.server.core.CoreModuleProvider;
import org.apache.skywalking.oap.server.library.util.ResourceUtils;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.SafeConstructor;
/**
* Apdex threshold configuration dictionary adapter. Looking up a service apdex threshold from dynamic config service.
@ -94,7 +95,7 @@ public class ApdexThresholdConfig extends ConfigChangeWatcher implements Configu
@SuppressWarnings("unchecked")
private void updateConfig(final Reader contentRender) {
dictionary = (Map<String, Integer>) new Yaml().load(contentRender);
dictionary = (Map<String, Integer>) new Yaml(new SafeConstructor()).load(contentRender);
if (dictionary == null) {
dictionary = Collections.emptyMap();
}