9b93e874a0
### _Why are the changes needed?_ upgrade snakeyaml from 1.33 to 2.2 reducing direct CVE vulnerabilities, see (https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes) [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond. ### _How was this patch tested?_ - [ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible - [ ] Add screenshots for manual tests if appropriate - [x] [Run test](https://kyuubi.readthedocs.io/en/master/contributing/code/testing.html#running-tests) locally before make a pull request ### _Was this patch authored or co-authored using generative AI tooling?_ No Closes #5293 from dev-lpq/snakeyaml_critical. Closes #5293 5b2412d8e [pengqli] upgrade snakeyaml from 1.33 to 2.2 Authored-by: pengqli <pengqli@cisco.com> Signed-off-by: Cheng Pan <chengpan@apache.org> |
||
|---|---|---|
| .. | ||
| gen | ||
| kyuubi-codecov | ||
| kyuubi-tpcds | ||
| checkout_pr.sh | ||
| dependencyList | ||
| merge_kyuubi_pr.py | ||
| reformat | ||