CVE-2022-38752

ali-security · Sep 19, 2024 · 94b1d7f · 94b1d7f
1 parent 69f47fd
commit 94b1d7f
Show file tree

Hide file tree

Showing 6 changed files with 37 additions and 17 deletions.
diff --git a/src/main/java/org/yaml/snakeyaml/constructor/BaseConstructor.java b/src/main/java/org/yaml/snakeyaml/constructor/BaseConstructor.java
@@ -221,21 +221,17 @@ protected Object constructObject(Node node) {
     }
 
     protected Object constructObjectNoCheck(Node node) {
-        if (recursiveObjects.contains(node)) {
-            throw new ConstructorException(null, null, "found unconstructable recursive node",
-                    node.getStartMark());
-        }
         recursiveObjects.add(node);
         Construct constructor = getConstructor(node);
         Object data = (constructedObjects.containsKey(node)) ? constructedObjects.get(node)
                 : constructor.construct(node);
 
         finalizeConstruction(node, data);
         constructedObjects.put(node, data);
-        recursiveObjects.remove(node);
         if (node.isTwoStepsConstruction()) {
             constructor.construct2ndStep(node, data);
         }
+        recursiveObjects.remove(node);
         return data;
     }
 

diff --git a/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java b/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java
@@ -90,12 +90,19 @@ protected void processDuplicateKeys(MappingNode node) {
             if (!keyNode.getTag().equals(Tag.MERGE)) {
                 Object key = constructObject(keyNode);
                 if (key != null) {
-                    try {
-                        key.hashCode();// check circular dependencies
-                    } catch (Exception e) {
-                        throw new ConstructorException("while constructing a mapping",
-                                node.getStartMark(), "found unacceptable key " + key,
-                                tuple.getKeyNode().getStartMark(), e);
+                    if (keyNode.isTwoStepsConstruction()) {
+                        if(!loadingConfig.getAllowRecursiveKeys()) {
+                          throw new YAMLException(
+                                "Recursive key is detected but it is not configured to be allowed.");
+                        } else {
+                            try {
+                                key.hashCode();// check circular dependencies
+                            } catch (Exception e) {
+                                throw new ConstructorException("while constructing a mapping",
+                                        node.getStartMark(), "found unacceptable key " + key,
+                                        tuple.getKeyNode().getStartMark(), e);
+                            }
+                        }
                     }
                 }
 

diff --git a/src/test/java/org/yaml/snakeyaml/issues/issue73/RecursiveSetTest.java b/src/test/java/org/yaml/snakeyaml/issues/issue73/RecursiveSetTest.java
@@ -21,6 +21,7 @@
 
 import junit.framework.TestCase;
 
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Util;
 import org.yaml.snakeyaml.Yaml;
 
@@ -58,7 +59,9 @@ public void testLoadException() {
     public void testLoadRecursiveTest() {
         String doc = Util.getLocalResource("issues/issue73-recursive5.txt");
         // System.out.println(doc);
-        Yaml yaml = new Yaml();
+        LoaderOptions options = new LoaderOptions();
+        options.setAllowRecursiveKeys(true);
+        Yaml yaml = new Yaml(options);
         Bean1 obj = (Bean1) yaml.load(doc);
         Set<Object> set = obj.getSet();
         // System.out.println(set);

diff --git a/src/test/java/org/yaml/snakeyaml/issues/issue73/RecursiveSortedSetTest.java b/src/test/java/org/yaml/snakeyaml/issues/issue73/RecursiveSortedSetTest.java
@@ -21,6 +21,7 @@
 
 import junit.framework.TestCase;
 
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Util;
 import org.yaml.snakeyaml.Yaml;
 
@@ -57,7 +58,9 @@ public void testLoadException() {
     public void testLoadRecursiveTest() {
         String doc = Util.getLocalResource("issues/issue73-recursive9.txt");
         // System.out.println(doc);
-        Yaml yaml = new Yaml();
+        LoaderOptions options = new LoaderOptions();
+        options.setAllowRecursiveKeys(true);
+        Yaml yaml = new Yaml(options);
         Bean11 beanWithSet = (Bean11) yaml.load(doc);
         Set<Object> set = beanWithSet.getSet();
         assertEquals(TreeSet.class, set.getClass());

diff --git a/src/test/java/org/yaml/snakeyaml/recursive/HumanTest.java b/src/test/java/org/yaml/snakeyaml/recursive/HumanTest.java
@@ -137,7 +137,10 @@ public void testChildren() {
         assertEquals(etalon, output);
         TypeDescription humanDescription = new TypeDescription(Human.class);
         humanDescription.putMapPropertyType("children", Human.class, Object.class);
-        Yaml beanLoader = new Yaml(new Constructor(humanDescription));
+            LoaderOptions loaderOptions = new LoaderOptions();
+        loaderOptions.setAllowRecursiveKeys(true);
+        Yaml beanLoader = new Yaml(new Constructor(humanDescription, loaderOptions));
+
         //
         Human son2 = beanLoader.loadAs(output, Human.class);
         assertNotNull(son2);
@@ -210,7 +213,10 @@ public void testChildrenPretty() {
         assertEquals(etalon, output);
         TypeDescription humanDescription = new TypeDescription(Human.class);
         humanDescription.putMapPropertyType("children", Human.class, Object.class);
-        Yaml beanLoader = new Yaml(new Constructor(humanDescription));
+        LoaderOptions loaderOptions = new LoaderOptions();
+        loaderOptions.setAllowRecursiveKeys(true);
+        Yaml beanLoader = new Yaml(new Constructor(humanDescription, loaderOptions));
+
         //
         Human son2 = beanLoader.loadAs(output, Human.class);
         assertNotNull(son2);
@@ -634,7 +640,10 @@ public void testChildrenWithoutRootTag() {
         assertEquals(etalon, output);
         TypeDescription humanDescription = new TypeDescription(Human.class);
         humanDescription.putMapPropertyType("children", Human.class, Object.class);
-        Yaml beanLoader = new Yaml(new Constructor(humanDescription));
+        LoaderOptions loaderOptions = new LoaderOptions();
+        loaderOptions.setAllowRecursiveKeys(true);
+        Yaml beanLoader = new Yaml(new Constructor(humanDescription, loaderOptions));
+
         //
         Human son2 = beanLoader.loadAs(output, Human.class);
         assertNotNull(son2);

diff --git a/src/test/java/org/yaml/snakeyaml/recursive/generics/HumanGenericsTest.java b/src/test/java/org/yaml/snakeyaml/recursive/generics/HumanGenericsTest.java
@@ -145,7 +145,9 @@ public void testChildren() throws IOException, IntrospectionException {
         mother.setChildren(children);
         //
 
-        Constructor constructor = new Constructor();
+        LoaderOptions options = new LoaderOptions();
+        options.setAllowRecursiveKeys(true);
+        Constructor constructor = new Constructor(options);
         TypeDescription humanDescription = new TypeDescription(HumanGen.class);
         humanDescription.putMapPropertyType("children", HumanGen.class, Object.class);
         constructor.addTypeDescription(humanDescription);