Use SafeConstructor() instead of Constructor() (opensearch-project#6205)

Signed-off-by: Andrew Ross <[email protected]>
sandeshkr419 · Feb 6, 2023 · a5dc22a · a5dc22a
1 parent 8c09378
commit a5dc22a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/server/src/main/java/org/opensearch/extensions/ExtensionsManager.java b/server/src/main/java/org/opensearch/extensions/ExtensionsManager.java
@@ -66,6 +66,7 @@
 import org.opensearch.transport.TransportService;
 import org.yaml.snakeyaml.Yaml;
 import org.opensearch.env.EnvironmentSettingsResponse;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 /**
  * The main class for managing Extension communication with the OpenSearch Node.
@@ -555,7 +556,7 @@ public String executor() {
     }
 
     private ExtensionsSettings readFromExtensionsYml(Path filePath) throws IOException {
-        Yaml yaml = new Yaml();
+        Yaml yaml = new Yaml(new SafeConstructor());
         try (InputStream inputStream = Files.newInputStream(filePath)) {
             Map<String, Object> obj = yaml.load(inputStream);
             if (obj == null) {