TINKERPOP-2902 bump snakeyaml to 2.0 and commons-configuration to 2.9.0

Author: acoady

CHANGELOG.asciidoc

@@ -33,6 +33,8 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima
 * Changed `gremlin-console` to add imports via an ImportCustomizer to reduce time spent resolving imports.
 * Bumped to Groovy 2.5.21.
 * Added `AuthInfoProvider` interface and `NewDynamicAuth()` to gremlin-go for dynamic authentication support.
+* Bumped to `snakeyaml` 2.0 to fix security vulnerability.
+* Bumped to Apache `commons-configuration` 2.9.0 to fix security vulnerability.
 
 [[release-3-5-5]]
 === TinkerPop 3.5.5 (Release Date: January 16, 2023)

gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java

@@ -21,6 +21,7 @@
 import org.apache.commons.configuration2.Configuration;
 import org.apache.tinkerpop.gremlin.driver.ser.GraphBinaryMessageSerializerV1;
 import org.apache.tinkerpop.gremlin.util.iterator.IteratorUtils;
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.TypeDescription;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.constructor.Constructor;
@@ -111,10 +112,11 @@ final class Settings {
     public static Settings read(final InputStream stream) {
         Objects.requireNonNull(stream);
 
-        final Constructor constructor = new Constructor(Settings.class);
+        final LoaderOptions options = new LoaderOptions();
+        final Constructor constructor = new Constructor(Settings.class, options);
         final TypeDescription settingsDescription = new TypeDescription(Settings.class);
-        settingsDescription.putListPropertyType("hosts", String.class);
-        settingsDescription.putListPropertyType("serializers", SerializerSettings.class);
+        settingsDescription.addPropertyParameters("hosts", String.class);
+        settingsDescription.addPropertyParameters("serializers", SerializerSettings.class);
         constructor.addTypeDescription(settingsDescription);
 
         final Yaml yaml = new Yaml(constructor);

gremlin-groovy/src/main/groovy/org/apache/tinkerpop/gremlin/groovy/jsr223/customizer/FileSandboxExtension.groovy

@@ -20,6 +20,7 @@ package org.apache.tinkerpop.gremlin.groovy.jsr223.customizer
 
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
+import org.yaml.snakeyaml.LoaderOptions
 import org.yaml.snakeyaml.TypeDescription
 import org.yaml.snakeyaml.Yaml
 import org.yaml.snakeyaml.constructor.Constructor
@@ -101,7 +102,8 @@ class FileSandboxExtension extends AbstractSandboxExtension {
         public Map<String,String> staticVariableTypes
 
         public static Settings read(final File file) throws Exception {
-            final Constructor constructor = new Constructor(Settings.class)
+            final LoaderOptions options = new LoaderOptions()
+            final Constructor constructor = new Constructor(Settings.class, options)
             final TypeDescription settingsDescription = new TypeDescription(Settings.class)
             settingsDescription.putListPropertyType("methodWhiteList", String.class)
             settingsDescription.putMapPropertyType("staticVariableTypes", String.class, String.class)

gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java

@@ -37,6 +37,7 @@
 import org.apache.tinkerpop.gremlin.structure.Graph;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.TypeDescription;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.constructor.Constructor;
@@ -336,7 +337,8 @@ public static Settings read(final String file) throws Exception {
      * @return a {@link Constructor} to parse a Gremlin Server YAML
      */
     protected static Constructor createDefaultYamlConstructor() {
-        final Constructor constructor = new Constructor(Settings.class);
+        final LoaderOptions options = new LoaderOptions();
+        final Constructor constructor = new Constructor(Settings.class, options);
         final TypeDescription settingsDescription = new TypeDescription(Settings.class);
         settingsDescription.addPropertyParameters("graphs", String.class, String.class);
         settingsDescription.addPropertyParameters("scriptEngines", String.class, ScriptEngineSettings.class);
@@ -346,7 +348,7 @@ protected static Constructor createDefaultYamlConstructor() {
         constructor.addTypeDescription(settingsDescription);
 
         final TypeDescription serializerSettingsDescription = new TypeDescription(SerializerSettings.class);
-        serializerSettingsDescription.putMapPropertyType("config", String.class, Object.class);
+        serializerSettingsDescription.addPropertyParameters("config", String.class, Object.class);
         constructor.addTypeDescription(serializerSettingsDescription);
 
         final TypeDescription scriptEngineSettingsDescription = new TypeDescription(ScriptEngineSettings.class);

gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/authz/AllowList.java

@@ -18,6 +18,7 @@
  */
 package org.apache.tinkerpop.gremlin.server.authz;
 
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.TypeDescription;
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.constructor.Constructor;
@@ -58,10 +59,11 @@ public class AllowList {
     public static AllowList read(final String file) throws Exception {
         final InputStream stream = new FileInputStream(new File(file));
 
-        final Constructor constructor = new Constructor(AllowList.class);
+        final LoaderOptions options = new LoaderOptions();
+        final Constructor constructor = new Constructor(AllowList.class, options);
         final TypeDescription allowListDescription = new TypeDescription(AllowList.class);
-        allowListDescription.putMapPropertyType("grants", String.class, Object.class);
-        allowListDescription.putMapPropertyType("groups", String.class, Object.class);
+        allowListDescription.addPropertyParameters("grants", String.class, Object.class);
+        allowListDescription.addPropertyParameters("groups", String.class, Object.class);
         constructor.addTypeDescription(allowListDescription);
 
         final Yaml yaml = new Yaml(constructor);

pom.xml

@@ -152,7 +152,7 @@ limitations under the License.
         <antlr4.version>4.9.1</antlr4.version>
         <caffeine.version>2.3.1</caffeine.version>
         <commons.collections.version>3.2.2</commons.collections.version>
-        <commons.configuration.version>2.8.0</commons.configuration.version>
+        <commons.configuration.version>2.9.0</commons.configuration.version>
         <commons.lang.version>2.6</commons.lang.version>
         <commons.io.version>2.8.0</commons.io.version>
         <commons.lang3.version>3.11</commons.lang3.version>
@@ -173,7 +173,7 @@ limitations under the License.
         <mockito.version>3.3.3</mockito.version>
         <netty.version>4.1.86.Final</netty.version>
         <slf4j.version>1.7.25</slf4j.version>
-        <snakeyaml.version>1.32</snakeyaml.version>
+        <snakeyaml.version>2.0</snakeyaml.version>
         <spark.version>3.0.0</spark.version>
         <powermock.version>2.0.9</powermock.version>