Switch to Yaml 1.2 with snakeyaml-engine

This PR replace snakeyaml with snakeyaml-engine in order to support YAML 1.2
Version 1.2 solves among others Norway problem https://hitchdev.com/strictyaml/why/implicit-typing-removed, mentioned in spring-projects/spring-boot#17113

The following compares versions 1.1 and 1.2: https://yaml.readthedocs.io/en/latest/pyyaml.html

I drop off 'supportedTypes' support. The feature was add in spring-projects/spring-framework#25152. I asked question for purpose, but I didn't get answer.

I decide to drop because:
1. Supported types are not directly provided by snakeyaml-engine
2. Clients - for example Spring Boot OriginTrackedYamlLoader - still may modify yaml setup
3. Supported types are not documented
4. I think that supported types is wrong idea. Parsing YAML should be simple and conversion may be implemented in application code.

Author: michaldo

build.gradle

@@ -84,7 +84,7 @@ configure(allprojects) { project ->
 				exclude group: "stax", name: "stax-api"
 			}
 			dependency "org.ogce:xpp3:1.1.6"
-			dependency "org.yaml:snakeyaml:1.30"
+			dependency "org.snakeyaml:snakeyaml-engine:2.3"
 
 			dependency "com.h2database:h2:2.1.210"
 			dependency "com.github.ben-manes.caffeine:caffeine:3.0.6"

spring-beans/spring-beans.gradle

@@ -5,7 +5,7 @@ apply plugin: "kotlin"
 dependencies {
 	api(project(":spring-core"))
 	optional("jakarta.inject:jakarta.inject-api")
-	optional("org.yaml:snakeyaml")
+	optional("org.snakeyaml:snakeyaml-engine")
 	optional("org.apache.groovy:groovy-xml")
 	optional("org.jetbrains.kotlin:kotlin-reflect")
 	optional("org.jetbrains.kotlin:kotlin-stdlib")
@@ -14,4 +14,4 @@ dependencies {
 	testImplementation("jakarta.annotation:jakarta.annotation-api")
 	testFixturesApi("org.junit.jupiter:junit-jupiter-api")
 	testFixturesImplementation("org.assertj:assertj-core")
-}
+}

spring-beans/src/main/java/org/springframework/beans/factory/config/YamlProcessor.java

@@ -17,37 +17,29 @@
 package org.springframework.beans.factory.config;
 
 import java.io.IOException;
-import java.io.Reader;
+import java.io.InputStream;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Properties;
-import java.util.Set;
-import java.util.stream.Collectors;
-
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.yaml.snakeyaml.DumperOptions;
-import org.yaml.snakeyaml.LoaderOptions;
-import org.yaml.snakeyaml.Yaml;
-import org.yaml.snakeyaml.constructor.Constructor;
-import org.yaml.snakeyaml.reader.UnicodeReader;
-import org.yaml.snakeyaml.representer.Representer;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
 
 import org.springframework.core.CollectionFactory;
 import org.springframework.core.io.Resource;
 import org.springframework.lang.Nullable;
 import org.springframework.util.Assert;
-import org.springframework.util.ObjectUtils;
 import org.springframework.util.StringUtils;
 
 /**
  * Base class for YAML factories.
  *
- * <p>Requires SnakeYAML 1.18 or higher, as of Spring Framework 5.0.6.
+ * <p>Requires SnakeYAML engine 2.3 or higher
  *
  * @author Dave Syer
  * @author Juergen Hoeller
@@ -67,9 +59,6 @@ public abstract class YamlProcessor {
 
 	private boolean matchDefault = true;
 
-	private Set<String> supportedTypes = Collections.emptySet();
-
-
 	/**
 	 * A map of document matchers allowing callers to selectively use only
 	 * some of the documents in a YAML resource. In YAML documents are
@@ -127,29 +116,6 @@ public void setResources(Resource... resources) {
 		this.resources = resources;
 	}
 
-	/**
-	 * Set the supported types that can be loaded from YAML documents.
-	 * <p>If no supported types are configured, only Java standard classes
-	 * (as defined in {@link org.yaml.snakeyaml.constructor.SafeConstructor})
-	 * encountered in YAML documents will be supported.
-	 * If an unsupported type is encountered, an {@link IllegalStateException}
-	 * will be thrown when the corresponding YAML node is processed.
-	 * @param supportedTypes the supported types, or an empty array to clear the
-	 * supported types
-	 * @since 5.1.16
-	 * @see #createYaml()
-	 */
-	public void setSupportedTypes(Class<?>... supportedTypes) {
-		if (ObjectUtils.isEmpty(supportedTypes)) {
-			this.supportedTypes = Collections.emptySet();
-		}
-		else {
-			Assert.noNullElements(supportedTypes, "'supportedTypes' must not contain null elements");
-			this.supportedTypes = Arrays.stream(supportedTypes).map(Class::getName)
-					.collect(Collectors.toUnmodifiableSet());
-		}
-	}
-
 	/**
 	 * Provide an opportunity for subclasses to process the Yaml parsed from the supplied
 	 * resources. Each resource is parsed in turn and the documents inside checked against
@@ -161,7 +127,7 @@ public void setSupportedTypes(Class<?>... supportedTypes) {
 	 * @see #createYaml()
 	 */
 	protected void process(MatchCallback callback) {
-		Yaml yaml = createYaml();
+		Load yaml = createYaml();
 		for (Resource resource : this.resources) {
 			boolean found = process(callback, yaml, resource);
 			if (this.resolutionMethod == ResolutionMethod.FIRST_FOUND && found) {
@@ -171,31 +137,21 @@ protected void process(MatchCallback callback) {
 	}
 
 	/**
-	 * Create the {@link Yaml} instance to use.
-	 * <p>The default implementation sets the "allowDuplicateKeys" flag to {@code false},
-	 * enabling built-in duplicate key handling in SnakeYAML 1.18+.
-	 * <p>As of Spring Framework 5.1.16, if custom {@linkplain #setSupportedTypes
-	 * supported types} have been configured, the default implementation creates
-	 * a {@code Yaml} instance that filters out unsupported types encountered in
-	 * YAML documents. If an unsupported type is encountered, an
-	 * {@link IllegalStateException} will be thrown when the node is processed.
-	 * @see LoaderOptions#setAllowDuplicateKeys(boolean)
+	 * Create the {@link Load} instance to use.
 	 */
-	protected Yaml createYaml() {
-		LoaderOptions loaderOptions = new LoaderOptions();
-		loaderOptions.setAllowDuplicateKeys(false);
-		return new Yaml(new FilteringConstructor(loaderOptions), new Representer(),
-				new DumperOptions(), loaderOptions);
+	protected Load createYaml() {
+		LoadSettings settings = LoadSettings.builder().build();
+		return  new Load(settings);
 	}
 
-	private boolean process(MatchCallback callback, Yaml yaml, Resource resource) {
+	private boolean process(MatchCallback callback, Load yaml, Resource resource) {
 		int count = 0;
 		try {
 			if (logger.isDebugEnabled()) {
 				logger.debug("Loading from YAML: " + resource);
 			}
-			try (Reader reader = new UnicodeReader(resource.getInputStream())) {
-				for (Object object : yaml.loadAll(reader)) {
+			try (InputStream is  = resource.getInputStream()) {
+				for (Object object : yaml.loadAllFromInputStream(is)) {
 					if (object != null && process(asMap(object), callback)) {
 						count++;
 						if (this.resolutionMethod == ResolutionMethod.FIRST_FOUND) {
@@ -428,24 +384,4 @@ public enum ResolutionMethod {
 		FIRST_FOUND
 	}
 
-
-	/**
-	 * {@link Constructor} that supports filtering of unsupported types.
-	 * <p>If an unsupported type is encountered in a YAML document, an
-	 * {@link IllegalStateException} will be thrown from {@link #getClassForName}.
-	 */
-	private class FilteringConstructor extends Constructor {
-
-		FilteringConstructor(LoaderOptions loaderOptions) {
-			super(loaderOptions);
-		}
-
-		@Override
-		protected Class<?> getClassForName(String name) throws ClassNotFoundException {
-			Assert.state(YamlProcessor.this.supportedTypes.contains(name),
-					() -> "Unsupported type encountered in YAML document: " + name);
-			return super.getClassForName(name);
-		}
-	}
-
 }

spring-beans/src/test/java/org/springframework/beans/factory/config/YamlMapFactoryBeanTests.java

@@ -22,7 +22,7 @@
 import java.util.Map;
 
 import org.junit.jupiter.api.Test;
-import org.yaml.snakeyaml.constructor.DuplicateKeyException;
+import org.snakeyaml.engine.v2.exceptions.DuplicateKeyException;
 
 import org.springframework.core.io.AbstractResource;
 import org.springframework.core.io.ByteArrayResource;

spring-beans/src/test/java/org/springframework/beans/factory/config/YamlProcessorTests.java

@@ -24,9 +24,9 @@
 import java.util.Set;
 
 import org.junit.jupiter.api.Test;
-import org.yaml.snakeyaml.constructor.ConstructorException;
-import org.yaml.snakeyaml.parser.ParserException;
-import org.yaml.snakeyaml.scanner.ScannerException;
+import org.snakeyaml.engine.v2.exceptions.ConstructorException;
+import org.snakeyaml.engine.v2.exceptions.ParserException;
+import org.snakeyaml.engine.v2.exceptions.ScannerException;
 
 import org.springframework.core.io.ByteArrayResource;
 
@@ -70,6 +70,13 @@ void stringResource() {
 		this.processor.process((properties, map) -> assertThat(map.get("document")).isEqualTo("foo"));
 	}
 
+	@Test
+	void norwayProblem() {
+		setYaml("foo: no");
+		this.processor.process((properties, map) ->
+			assertThat(map.get("foo")).as("In YAML 1.1 it would be: false").isEqualTo("no"));
+	}
+
 	@Test
 	void badDocumentStart() {
 		setYaml("foo # a document\nbar: baz");
@@ -158,31 +165,7 @@ void customTypeNotSupportedByDefault() throws Exception {
 		setYaml("value: !!java.net.URL [\"" + url + "\"]");
 		assertThatExceptionOfType(ConstructorException.class)
 				.isThrownBy(() -> this.processor.process((properties, map) -> {}))
-				.withMessageContaining("Unsupported type encountered in YAML document: java.net.URL");
-	}
-
-	@Test
-	void customTypesSupportedDueToExplicitConfiguration() throws Exception {
-		this.processor.setSupportedTypes(URL.class, String.class);
-
-		URL url = new URL("https://localhost:9000/");
-		setYaml("value: !!java.net.URL [!!java.lang.String [\"" + url + "\"]]");
-
-		this.processor.process((properties, map) -> {
-			assertThat(properties).containsExactly(entry("value", url));
-			assertThat(map).containsExactly(entry("value", url));
-		});
-	}
-
-	@Test
-	void customTypeNotSupportedDueToExplicitConfiguration() {
-		this.processor.setSupportedTypes(List.class);
-
-		setYaml("value: !!java.net.URL [\"https://localhost:9000/\"]");
-
-		assertThatExceptionOfType(ConstructorException.class)
-				.isThrownBy(() -> this.processor.process((properties, map) -> {}))
-				.withMessageContaining("Unsupported type encountered in YAML document: java.net.URL");
+				.withMessageContaining("java.net.URL");
 	}
 
 	private void setYaml(String yaml) {

spring-beans/src/test/java/org/springframework/beans/factory/config/YamlPropertiesFactoryBeanTests.java

@@ -20,9 +20,9 @@
 import java.util.Properties;
 
 import org.junit.jupiter.api.Test;
-import org.yaml.snakeyaml.Yaml;
-import org.yaml.snakeyaml.constructor.DuplicateKeyException;
-import org.yaml.snakeyaml.scanner.ScannerException;
+
+import org.snakeyaml.engine.v2.exceptions.DuplicateKeyException;
+import org.snakeyaml.engine.v2.exceptions.ScannerException;
 
 import org.springframework.beans.factory.config.YamlProcessor.MatchStatus;
 import org.springframework.beans.factory.config.YamlProcessor.ResolutionMethod;
@@ -225,14 +225,4 @@ void loadArrayOfObject() {
 		assertThat(properties.getProperty("foo[2].three")).isEqualTo("four");
 		assertThat(properties.get("foo")).isNull();
 	}
-
-	@Test
-	@SuppressWarnings("unchecked")
-	void yaml() {
-		Yaml yaml = new Yaml();
-		Map<String, ?> map = yaml.loadAs("foo: bar\nspam:\n  foo: baz", Map.class);
-		assertThat(map.get("foo")).isEqualTo("bar");
-		assertThat(((Map<String, Object>) map.get("spam")).get("foo")).isEqualTo("baz");
-	}
-
 }