【snakeyaml升级2.x重写类源文件】

/** * Copyright (c) 2008, SnakeYAML * * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except * in compliance with the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software distributed under the License * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express * or implied. See the License for the specific language governing permissions and limitations under * the License. */ package org.yaml.snakeyaml.constructor; import java.math.BigDecimal; import java.math.BigInteger; import java.util.ArrayList; import java.util.Calendar; import java.util.Collection; import java.util.Date; import java.util.List; import java.util.Map; import java.util.Set; import java.util.UUID; import org.yaml.snakeyaml.LoaderOptions; import org.yaml.snakeyaml.TypeDescription; import org.yaml.snakeyaml.error.YAMLException; import org.yaml.snakeyaml.introspector.Property; import org.yaml.snakeyaml.nodes.MappingNode; import org.yaml.snakeyaml.nodes.Node; import org.yaml.snakeyaml.nodes.NodeId; import org.yaml.snakeyaml.nodes.NodeTuple; import org.yaml.snakeyaml.nodes.ScalarNode; import org.yaml.snakeyaml.nodes.SequenceNode; import org.yaml.snakeyaml.nodes.Tag; import org.yaml.snakeyaml.util.EnumUtils; /** * 漏洞修复重写Constructor类 * 原因 snakeYaml 1.x存在漏洞，需要升级至2.x,但springBoot2.7.10以下版本不支持snakeYaml2.x,因为snakeYaml2.x的Constructor中去掉了无参构造 * 所以在此处重写snakeYaml2.x的Constructor类，新增无参构造 * @Author haibo.li * @Date 2024/2/28 11:51 */ public class Constructor extends SafeConstructor { public Constructor() { this(Object.class,new LoaderOptions()); this.loadingConfig.setAllowDuplicateKeys(false); } /** * Create with options * * @param loadingConfig - config */ public Constructor(LoaderOptions loadingConfig) { this(Object.class, loadingConfig); } /** * Create * * @param theRoot - the class to create (to be the root of the YAML document) * @param loadingConfig - options */ public Constructor(Class<? extends Object> theRoot, LoaderOptions loadingConfig) { this(new TypeDescription(checkRoot(theRoot)), null, loadingConfig); } /** * Ugly Java way to check the argument in the constructor */ private static Class<? extends Object> checkRoot(Class<? extends Object> theRoot) { if (theRoot == null) { throw new NullPointerException("Root class must be provided."); } else { return theRoot; } } /** * Create * * @param theRoot - the root class to create * @param loadingConfig options */ public Constructor(TypeDescription theRoot, LoaderOptions loadingConfig) { this(theRoot, null, loadingConfig); } /** * Create with all possible arguments * * @param theRoot - the class (usually JavaBean) to be constructed * @param moreTDs - collection of classes used by the root class * @param loadingConfig - configuration */ public Constructor(TypeDescription theRoot, Collection<TypeDescription> moreTDs, LoaderOptions loadingConfig) { super(loadingConfig); if (theRoot == null) { throw new NullPointerException("Root type must be provided."); } // register a general Construct when the explicit one was not found this.yamlConstructors.put(null, new ConstructYamlObject()); // register the root tag to begin with its Construct if (!Object.class.equals(theRoot.getType())) { rootTag = new Tag(theRoot.getType()); } yamlClassConstructors.put(NodeId.scalar, new ConstructScalar()); yamlClassConstructors.put(NodeId.mapping, new ConstructMapping()); yamlClassConstructors.put(NodeId.sequence, new ConstructSequence()); addTypeDescription(theRoot); if (moreTDs != null) { for (TypeDescription td : moreTDs) { addTypeDescription(td); } } } /** * Create * * @param theRoot - the main class to crate * @param loadingConfig - options * @throws ClassNotFoundException if something goes wrong */ public Constructor(String theRoot, LoaderOptions loadingConfig) throws ClassNotFoundException { this(Class.forName(check(theRoot)), loadingConfig); } private static String check(String s) { if (s == null) { throw new NullPointerException("Root type must be provided."); } if (s.trim().length() == 0) { throw new YAMLException("Root type must be provided."); } return s; } /** * Construct mapping instance (Map, JavaBean) when the runtime class is known. */ protected class ConstructMapping implements Construct { /** * Construct JavaBean. If type safe collections are used please look at * <code>TypeDescription</code>. * * @param node node where the keys are property names (they can only be <code>String</code>s) * and values are objects to be created * @return constructed JavaBean */ public Object construct(Node node) { MappingNode mnode = (MappingNode) node; if (Map.class.isAssignableFrom(node.getType())) { if (node.isTwoStepsConstruction()) { return newMap(mnode); } else { return constructMapping(mnode); } } else if (Collection.class.isAssignableFrom(node.getType())) { if (node.isTwoStepsConstruction()) { return newSet(mnode); } else { return constructSet(mnode); } } else { Object obj = Constructor.this.newInstance(mnode); if (obj != NOT_INSTANTIATED_OBJECT) { if (node.isTwoStepsConstruction()) { return obj; } else { return constructJavaBean2ndStep(mnode, obj); } } else { throw new ConstructorException(null, null, "Can't create an instance for " + mnode.getTag(), node.getStartMark()); } } } @SuppressWarnings("unchecked") public void construct2ndStep(Node node, Object object) { if (Map.class.isAssignableFrom(node.getType())) { constructMapping2ndStep((MappingNode) node, (Map<Object, Object>) object); } else if (Set.class.isAssignableFrom(node.getType())) { constructSet2ndStep((MappingNode) node, (Set<Object>) object); } else { constructJavaBean2ndStep((MappingNode) node, object); } } // protected Object createEmptyJavaBean(MappingNode node) { // try { // Object instance = Constructor.this.newInstance(node); // if (instance != null) { // return instance; // } // // /** // * Using only default constructor. Everything else will be // * initialized on 2nd step. If we do here some partial // * initialization, how do we then track what need to be done on // * 2nd step? I think it is better to get only object here (to // * have it as reference for recursion) and do all other thing on /