[devin-ai-integration]

Summary

Fixes code-scan finding sfind-b4a7f20d (SNYK-JAVA-ORGYAML-537645 / CVE-2017-18640, the "billion laughs" DoS through YAML aliases). The vulnerable snakeyaml 1.17 comes in transitively: spring-boot-starter-web 1.5.4 → spring-boot-starter → org.yaml:snakeyaml:1.17.

 <properties>
   <java.version>1.8</java.version>
+  <snakeyaml.version>1.26</snakeyaml.version>
 </properties>

• snakeyaml.version is the property the Boot 1.5 BOM already uses, so overriding it is the smallest change. 1.26 is the lowest fixed version. It adds LoaderOptions.maxAliasesForCollections (default 50).
• The Boot parent and the Java version (1.8) are unchanged. 1.17 → 1.26 is a minor bump within 1.x, not a major one.
• UserFront has no application.yml (only application.properties), so snakeyaml only matters when Boot's YamlPropertySourceLoader parses YAML.

Verification

I couldn't reach Maven Central or api.snyk.io from this session, and the 1.5.4 parent isn't in the local cache. Instead I used the cached Boot 1.5.8 parent and jars as a stand-in:

• Dependency tree (maven-dependency-plugin:3.6.1:tree -Dincludes=org.yaml on a copy of the pom with the 1.5.8 parent):
  • master: org.yaml:snakeyaml:jar:1.17:runtime
  • this branch: org.yaml:snakeyaml:jar:1.26:runtime
• Alias-bomb proof through Boot's own YamlPropertySourceLoader (spring-boot 1.5.8, Spring 4.3.12, -Xmx256m, 10 levels × 9 aliases):
  • 1.17: java.lang.OutOfMemoryError: Java heap space after about 6.4 s
  • 1.26: YAMLException: Number of aliases for non-scalar nodes exceeds the specified max=50 after about 65 ms
• Regular YAML still loads with 1.26 through the same loader, including nested keys and <<: *anchor merge keys. The flattened properties are the same as with 1.17.

Snyk issue count (not re-run, the CLI can't reach api.snyk.io): before, 1 issue for SNYK-JAVA-ORGYAML-537645 (snakeyaml 1.17 is in the vulnerable range [,1.26)). After, 0 expected, because 1.26 is outside that range. I did not get this number from a Snyk re-scan.

Not run: mvn test on the real 1.5.4 parent. It needs Maven Central, and the only test (UserFrontApplicationTests.contextLoads) also needs MySQL.

Still open: the later snakeyaml CVEs (CVE-2022-25857, CVE-2022-38749/50/51/52, CVE-2022-41854 need 1.31–1.33; CVE-2022-1471 needs 2.x).

Overlaps: older open PRs #160, #210, #218, #226 and #228 pin snakeyaml 1.31–1.33, and #171 pins 2.0. Each of those also clears this CVE. This PR was opened for the new finding as required, but only one snakeyaml pin should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/13945660dd064444bf2f4f43857e5473
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/13945660dd064444bf2f4f43857e5473?variant=devin

---