From 66a776f7340d83e2a6c5a13232a6066f1948b4c9 Mon Sep 17 00:00:00 2001
From: Kyle Pollich <kyle.pollich@elastic.co>
Date: Fri, 16 Aug 2024 06:55:41 -0400
Subject: [PATCH] Replace all references to unsafe YML load/dump methods in
 Fleet codebase

---
 .../custom_integrations/assets/dataset/ingest_pipeline.ts     | 4 ++--
 .../packages/custom_integrations/assets/dataset/manifest.ts   | 4 ++--
 .../epm/packages/custom_integrations/assets/manifest.ts       | 4 ++--
 .../plugins/fleet/server/services/epm/packages/utils.test.ts  | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/ingest_pipeline.ts b/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/ingest_pipeline.ts
index 0021f395158e6..4d7313cacff72 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/ingest_pipeline.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/ingest_pipeline.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import * as yaml from 'js-yaml';
+import { safeDump } from 'js-yaml';
 
 // NOTE: The install methods will take care of adding a reference to a @custom pipeline. We don't need to add one here.
 export const createDefaultPipeline = (dataset: string, type: string) => {
@@ -25,5 +25,5 @@ export const createDefaultPipeline = (dataset: string, type: string) => {
       managed: true,
     },
   };
-  return yaml.dump(pipeline);
+  return safeDump(pipeline);
 };
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/manifest.ts b/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/manifest.ts
index 75b34867f6d07..efca290e31092 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/manifest.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/dataset/manifest.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import * as yaml from 'js-yaml';
+import { safeDump } from 'js-yaml';
 
 import { convertStringToTitle } from '../../utils';
 import type { AssetOptions } from '../generate';
@@ -17,5 +17,5 @@ export const createDatasetManifest = (dataset: string, assetOptions: AssetOption
     title: convertStringToTitle(dataset),
     type,
   };
-  return yaml.dump(manifest);
+  return safeDump(manifest);
 };
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/manifest.ts b/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/manifest.ts
index cf308f03db7dd..4c27ad6c45343 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/manifest.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/custom_integrations/assets/manifest.ts
@@ -4,7 +4,7 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import * as yaml from 'js-yaml';
+import { safeDump } from 'js-yaml';
 
 import type { AssetOptions } from './generate';
 
@@ -34,5 +34,5 @@ export const createManifest = (assetOptions: AssetOptions) => {
     },
   };
 
-  return yaml.dump(manifest);
+  return safeDump(manifest);
 };
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/utils.test.ts b/x-pack/plugins/fleet/server/services/epm/packages/utils.test.ts
index 166687a836fb1..8de21942d7552 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/utils.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/utils.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { dump } from 'js-yaml';
+import { safeDump } from 'js-yaml';
 
 import type { AssetsMap } from '../../../../common/types';
 
@@ -14,7 +14,7 @@ import type { RegistryDataStream } from '../../../../common';
 import { resolveDataStreamFields } from './utils';
 
 describe('resolveDataStreamFields', () => {
-  const statusAssetYml = dump([
+  const statusAssetYml = safeDump([
     {
       name: 'apache.status',
       type: 'group',