[devin-ai-integration]

Summary

Fixes code-scan finding sfind-d89b07cc (SNYK-JAVA-ORGYAML-3016889, CVE-2022-38750, low, CWE-121). UserFront gets org.yaml:snakeyaml@1.17 transitively through spring-boot-starter-web@1.5.4.RELEASE. In that version a deeply nested YAML document makes BaseConstructor.constructObject overflow the stack (DoS).

 <properties>
   <java.version>1.8</java.version>
+  <snakeyaml.version>1.33</snakeyaml.version>
 </properties>

snakeyaml.version is the property the Boot 1.5.x spring-boot-dependencies BOM uses to manage snakeyaml. The override changes only that artifact. The Spring Boot parent and the Java version (1.8) stay as they are.

Why 1.33 rather than 1.31: 1.31 is the smallest version that clears this one CVE. 1.33 is the smallest version that clears every snakeyaml 1.x finding on this package (CVE-2022-38749/38750/25857 are fixed in 1.31; CVE-2022-38751/38752/41854 are fixed in 1.32/1.32/1.32+). It is also where Snyk's own upgrade path ends up, and it is a minor bump within 1.x, not a major one. Flag: CVE-2022-1471 is not fixed here. It needs snakeyaml 2.x, and that breaks Boot 1.5's YamlPropertySourceLoader, so it is left out on purpose.

Duplicates: these open PRs already pin snakeyaml in UserFront/pom.xml: #160 and #226 (1.33), #218 and #228 (1.31), #210/#290/#394 (1.32), #171 (2.0). This PR is opened separately because each new finding gets its own PR. Only one of them should land.

Verification (offline; Maven Central and api.snyk.io are blocked by the session network policy)

• Snyk re-scan: not possible. snyk test --file=UserFront/pom.xml fails with SNYK-CLI-0000 because it can't reach api.snyk.io, so there are no before/after issue counts to quote. Please re-run the Snyk scan in CI or the Snyk UI.
• Resolved tree: the 1.5.4.RELEASE parent isn't cached locally, so I ran this on a copy of the pom with the cached 1.5.8.RELEASE parent (same snakeyaml.version BOM mechanism), using mvn -o dependency:tree -Dincludes=org.yaml:
  • before: spring-boot-starter-web -> spring-boot-starter -> org.yaml:snakeyaml:1.17
  • after: spring-boot-starter-web -> spring-boot-starter -> org.yaml:snakeyaml:1.33
• Behaviour probe (Boot 1.5.8 YamlPropertySourceLoader + Spring 4.3.12, -Xss512k):

  == snakeyaml 1.17
  Boot YamlPropertySourceLoader OK: server.port=8080 spring.datasource.url=jdbc:mysql://localhost:3306/onlinebanking
  crafted YAML (100000 nested '['): StackOverflowError -> VULNERABLE (CVE-2022-38750 DoS)
  == snakeyaml 1.33
  Boot YamlPropertySourceLoader OK: server.port=8080 spring.datasource.url=jdbc:mysql://localhost:3306/onlinebanking
  crafted YAML (100000 nested '['): rejected with YAMLException: Nesting Depth exceeded max 50
  

  Boot's YAML loader still works with 1.33. UserFront uses application.properties and has no application.yml.
• Not run: mvn test and an app boot. The Boot 1.5.4/1.5.8 thymeleaf/security starters and the MySQL connector aren't in the local Maven cache, and Central is blocked. The only test is UserFrontApplicationTests.contextLoads, and it also needs MySQL.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/d5162ac60b44412e821ee3525a039be4
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/d5162ac60b44412e821ee3525a039be4?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.