test: add YamlCodec security tests

[jay666mnj]

What is the purpose of the change

Add tests for YamlCodec to ensure YAML Java class tags are checked by Dubbo serialization security.

Brief changelog

• Add YamlCodecTest
• Verify normal YAML decoding to POJO
• Verify unsafe YAML class tag is rejected in STRICT mode

Verifying this change

• $env:JAVA_TOOL_OPTIONS='-Dfile.encoding=UTF-8'; .\mvnw.cmd -pl dubbo-remoting/dubbo-remoting-http12 -Dtest=YamlCodecTest test

Fixes #13799

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.78%. Comparing base (3dbba26) to head (86fed5f).

Additional details and impacted files

@@             Coverage Diff              @@
##                3.3   #16282      +/-   ##
============================================
- Coverage     60.85%   60.78%   -0.08%     
+ Complexity    11779    11769      -10     
============================================
  Files          1953     1953              
  Lines         89186    89186              
  Branches      13454    13454              
============================================
- Hits          54277    54209      -68     
- Misses        29353    29413      +60     
- Partials       5556     5564       +8     

Flag	Coverage Δ
integration-tests-java21	32.11% <ø> (-0.06%)	⬇️
integration-tests-java8	32.26% <ø> (+<0.01%)	⬆️
samples-tests-java21	32.12% <ø> (-0.11%)	⬇️
samples-tests-java8	29.76% <ø> (-0.14%)	⬇️
unit-tests-java11	59.00% <ø> (-0.08%)	⬇️
unit-tests-java17	58.50% <ø> (-0.09%)	⬇️
unit-tests-java21	58.49% <ø> (-0.11%)	⬇️
unit-tests-java25	58.45% <ø> (-0.09%)	⬇️
unit-tests-java8	59.02% <ø> (-0.11%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[RainYuY]

LGTM

[jay666mnj]

Thanks a lot for approving this PR! Now that we have 2 approvals as required, could this PR be merged? Let me know if anything else is needed. Thanks, 原始邮件 发件人：Sean Yang ***@***.***> 发件时间：2026年5月29日 18:31 收件人：apache/dubbo ***@***.***> 抄送：yijie zhao ***@***.***>, Author ***@***.***> 主题：Re: [apache/dubbo] test: add YamlCodec security tests (PR #16282) @oxsean approved this pull request. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you authored the thread.

[jay666mnj]

Thanks a lot for approving this PR! Now that we have 2 approvals as required, could this PR be merged? Let me know if anything else is needed. Thanks, 原始邮件 发件人：Yukina ***@***.***> 发件时间：2026年5月29日 14:16 收件人：apache/dubbo ***@***.***> 抄送：yijie zhao ***@***.***>, Author ***@***.***> 主题：Re: [apache/dubbo] test: add YamlCodec security tests (PR #16282) @RainYuY approved this pull request. LGTM — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you authored the thread.