Add steps to read and write TOML file

[a1k0u]

Add steps to work with TOML files/text. We are going to use these new steps to work with BuildKit configuration files in own pipeline/shared library. The realization is similar to JSON steps.

I chose com.fasterxml.jackson.dataformat.jackson-dataformat-toml, because this library implements the latest version of TOML specification (v1.0.0) and was recommended by official WIKI.

Testing done

Test cases are similar to JSON realization.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[a1k0u]

@rsandell, hello! Can you review this PR, please? 🙏

[rsandell]

I am not familiar with TOML, but the yaml read step has extra configuration in place to avoid mapping to complex objects for security reasons, for example to avoid loading a class with a vulnerable static initializer that could be utilized by a nefarious user. Is that a precaution that can be taken here as well?
The mapping to Object.class was reminding me of it and made me nervous :)

[a1k0u]

It took some time to get back to work on this pull request 😄

Thanks for review. I have understood the idea of CVE-2022-1471 vulnerability (I hope you mentioned exactly this problem)

TOML format is much easier than YAML. TOML operates with simple data structures which have already defined in the code. It is similar to SafeConstructor in SnakeYAML. So, no extra classes can be initialized during parsing

com.fasterxml.jackson.dataformat.toml package very small and simple, it delegates all work on tomlj and com.fasterxml.jackson.databind.ObjectMapper. This package extends ObjectMapper class with custom input/output decorators. Before mapping on the given structure (Object.class in this case, no one will be able to change the mapping class), it converts TOML to JSON (because TOML is just a map) and after that jackson packages work with the data as if it were a json file

[rsandell]

Could you update https://github.com/jenkinsci/pipeline-utility-steps-plugin/blob/master/docs/STEPS.md as well please?

[a1k0u]

@rsandell, thank you! I've updated STEPS.md

[rsandell]

Thank you!