Merge pull request #357 from jkobejs/jkobejs/fix-356

circe · Feb 28, 2023 · 0d9467f · 0d9467f
2 parents f1a0786 + dbce4bc
commit 0d9467f
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/circe-yaml/src/main/scala/io/circe/yaml/Parser.scala b/circe-yaml/src/main/scala/io/circe/yaml/Parser.scala
@@ -66,11 +66,13 @@ final case class Parser(
   def parseDocuments(yaml: String): Stream[Either[ParsingFailure, Json]] = parseDocuments(new StringReader(yaml))
 
   private[this] def parseSingle(reader: Reader): Either[ParsingFailure, Node] =
-    Either.catchNonFatal(new Yaml(loaderOptions).compose(reader)).leftMap(err => ParsingFailure(err.getMessage, err))
+    Either
+      .catchNonFatal(new Yaml(new SafeConstructor(loaderOptions)).compose(reader))
+      .leftMap(err => ParsingFailure(err.getMessage, err))
 
   private[this] def parseStream(reader: Reader): Either[ParsingFailure, Stream[Node]] =
     Either
-      .catchNonFatal(new Yaml(loaderOptions).composeAll(reader).asScala.toStream)
+      .catchNonFatal(new Yaml(new SafeConstructor(loaderOptions)).composeAll(reader).asScala.toStream)
       .leftMap(err => ParsingFailure(err.getMessage, err))
 
   def copy(

diff --git a/circe-yaml/src/main/scala/io/circe/yaml/parser/package.scala b/circe-yaml/src/main/scala/io/circe/yaml/parser/package.scala
@@ -21,6 +21,7 @@ import cats.syntax.either._
 import io.circe._
 import org.yaml.snakeyaml.LoaderOptions
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import org.yaml.snakeyaml.nodes._
 
 import java.io._
@@ -56,11 +57,13 @@ package object parser extends io.circe.yaml.common.Parser {
 
   @deprecated("moved to Parser.CustomTag", since = "0.14.2")
   private[this] def parseSingle(reader: Reader): Either[ParsingFailure, Node] =
-    Either.catchNonFatal(new Yaml(loaderOptions).compose(reader)).leftMap(err => ParsingFailure(err.getMessage, err))
+    Either
+      .catchNonFatal(new Yaml(new SafeConstructor(loaderOptions)).compose(reader))
+      .leftMap(err => ParsingFailure(err.getMessage, err))
 
   @deprecated("moved to Parser.CustomTag", since = "0.14.2")
   private[this] def parseStream(reader: Reader): Stream[Node] =
-    new Yaml(loaderOptions).composeAll(reader).asScala.toStream
+    new Yaml(new SafeConstructor(loaderOptions)).composeAll(reader).asScala.toStream
 
   @deprecated("moved to Parser.CustomTag", since = "0.14.2")
   private[this] object CustomTag {