elastic · elena-shostak · Sep 19, 2024 · Aug 19, 2024 · Aug 19, 2024 · Aug 19, 2024
@@ -38,15 +38,13 @@ async function main() {
 
   const preamble = locationFileLines.slice(0, 1);
 
-  // eslint-disable-next-line @kbn/eslint/no_unsafe_js_yaml
   const locationObj = jsYaml.load(
     locationFileLines.slice(1).join('\n')
   ) as BackstageLocationResource;
   locationObj.spec.targets = pipelines.map(
     (fileName) => `${resourceDefinitionsBaseUrl}/${fileName}`
   );
 
-  // eslint-disable-next-line @kbn/eslint/no_unsafe_js_yaml
   const locationYaml = jsYaml.dump(locationObj, { lineWidth: 400 });
 
   fs.writeFileSync(locationFile, `${preamble.join('\n')}\n${locationYaml}`);

@@ -7,7 +7,6 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-// eslint-disable-next-line @kbn/eslint/no_unsafe_js_yaml
 import { dump } from 'js-yaml';
 import { BuildkiteClient, BuildkiteCommandStep } from './buildkite';
 

@@ -10,7 +10,6 @@
 import axios, { AxiosInstance } from 'axios';
 import { execSync, ExecSyncOptions } from 'child_process';
 
-// eslint-disable-next-line @kbn/eslint/no_unsafe_js_yaml
 import { dump } from 'js-yaml';
 
 import { parseLinkHeader } from './parse_link_header';

@@ -12,7 +12,6 @@ import * as Fs from 'fs';
 import * as globby from 'globby';
 import minimatch from 'minimatch';
 
-// eslint-disable-next-line @kbn/eslint/no_unsafe_js_yaml
 import { load as loadYaml } from 'js-yaml';
 
 import { BuildkiteClient, BuildkiteStep } from '../buildkite';

diff --git a/package.json b/package.json
@@ -1118,7 +1118,7 @@
     "jquery": "^3.5.0",
     "js-search": "^1.4.3",
     "js-sha256": "^0.9.0",
-    "js-yaml": "^3.14.1",
+    "js-yaml": "^4.1.0",
     "json-schema-to-ts": "^2.9.1",
     "json-stable-stringify": "^1.0.1",
     "json-stringify-pretty-compact": "1.2.0",
@@ -1549,7 +1549,7 @@
     "@types/jest": "^29.5.3",
     "@types/jquery": "^3.3.31",
     "@types/js-search": "^1.4.0",
-    "@types/js-yaml": "^3.11.1",
+    "@types/js-yaml": "^4.0.9",
     "@types/jsdom": "^20.0.1",
     "@types/json-schema": "^7",
     "@types/json-stable-stringify": "^1.0.32",

@@ -8,15 +8,15 @@
  */
 
 import { readFileSync } from 'fs';
-import { safeLoad } from 'js-yaml';
+import { load } from 'js-yaml';
 
 import { set } from '@kbn/safer-lodash-set';
 import { ensureDeepObject } from '@kbn/std';
 import { isPlainObject } from 'lodash';
 
 const readYaml = (path: string) => {
   try {
-    return safeLoad(readFileSync(path, 'utf8'));
+    return load(readFileSync(path, 'utf8'));
   } catch (e) {
     /* tslint:disable:no-empty */
   }

@@ -8,13 +8,13 @@
  */
 
 import { readFileSync } from 'fs';
-import { safeLoad } from 'js-yaml';
+import { load } from 'js-yaml';
 import { set } from '@kbn/safer-lodash-set';
 import { isPlainObject } from 'lodash';
 import { ensureValidObjectPath } from '@kbn/std';
 import { splitKey, getUnsplittableKey, replaceEnvVarRefs } from './utils';
 
-const readYaml = (path: string) => safeLoad(readFileSync(path, 'utf8'));
+const readYaml = (path: string) => load(readFileSync(path, 'utf8'));
 
 interface YamlEntry {
   path: string[];
@@ -76,7 +76,7 @@ export const getConfigFromFiles = (configFiles: readonly string[]) => {
 
   for (const configFile of configFiles) {
     const yaml = readYaml(configFile);
-    if (yaml !== null) {
+    if (yaml) {
       yamlEntries.push(...listEntries(yaml));
     }
   }

@@ -38,7 +38,7 @@ export async function getAllDocFileIds(outputDir: string) {
 
     let fm;
     try {
-      fm = Yaml.safeLoad(fmYaml.slice(0, fmEnd.index));
+      fm = Yaml.load(fmYaml.slice(0, fmEnd.index));
       if (typeof fm !== 'object' || fm === null) {
         throw new Error('expected yaml to produce an object');
       }

@@ -9,6 +9,7 @@
   },
   "include": [
     "**/*.ts",
+    "../../typings/**/*"
   ],
   "exclude": [
     "**/__fixtures__/**",

@@ -9,7 +9,7 @@
 
 import fs from 'fs';
 import { extname } from 'path';
-import { safeLoad as loadYaml } from 'js-yaml';
+import { load as loadYaml } from 'js-yaml';
 
 export const readRolesFromResource = (resourcePath: string) => {
   if (!fs.existsSync(resourcePath) || extname(resourcePath) !== '.yml') {

@@ -314,7 +314,6 @@ module.exports = {
     '@kbn/eslint/no_constructor_args_in_property_initializers': 'error',
     '@kbn/eslint/no_this_in_property_initializers': 'error',
     '@kbn/eslint/no_unsafe_console': 'error',
-    '@kbn/eslint/no_unsafe_js_yaml': 'error',
     '@kbn/imports/no_unresolvable_imports': 'error',
     '@kbn/imports/uniform_imports': 'error',
     '@kbn/imports/no_unused_imports': 'error',

@@ -51,7 +51,7 @@ export class ServerlessAuthProvider implements AuthProvider {
   }
 
   getSupportedRoleDescriptors(): Record<string, unknown> {
-    return readRolesDescriptorsFromResource(this.rolesDefinitionPath);
+    return readRolesDescriptorsFromResource(this.rolesDefinitionPath) as Record<string, unknown>;
   }
   getDefaultRole(): string {
     return getDefaultServerlessRole(this.projectType);

@@ -19,7 +19,7 @@ import {
 export class StatefulAuthProvider implements AuthProvider {
   private readonly rolesDefinitionPath = resolve(REPO_ROOT, STATEFUL_ROLES_ROOT_PATH, 'roles.yml');
   getSupportedRoleDescriptors(): Record<string, unknown> {
-    return readRolesDescriptorsFromResource(this.rolesDefinitionPath);
+    return readRolesDescriptorsFromResource(this.rolesDefinitionPath) as Record<string, unknown>;
   }
   getDefaultRole() {
     return 'editor';

@@ -9,6 +9,7 @@
   },
   "include": [
     "**/*.ts",
+    "../../typings/**/*"
   ],
   "kbn_references": [
     "@kbn/core-saved-objects-server",

@@ -8,7 +8,7 @@
  */
 
 import chalk from 'chalk';
-import { safeDump } from 'js-yaml';
+import { dump } from 'js-yaml';
 import { isPlainObjectType } from './is_plain_object_type';
 
 /**
@@ -33,7 +33,7 @@ export function extractByJsonPointer(document: unknown, pointer: string): unknow
       throw new Error(
         `JSON Pointer ${chalk.bold(pointer)} resolution failure. Expected ${chalk.magenta(
           path.join('/')
-        )} to be a plain object but it has type "${typeof target}" in \n\n${safeDump(document, {
+        )} to be a plain object but it has type "${typeof target}" in \n\n${dump(document, {
           skipInvalid: true,
         })}`
       );
@@ -69,7 +69,7 @@ export function extractObjectByJsonPointer(
     throw new Error(
       `JSON Pointer resolution failure. Expected ${chalk.magenta(
         pointer
-      )} to be a plain object in \n\n${safeDump(document, { skipInvalid: true })}`
+      )} to be a plain object in \n\n${dump(document, { skipInvalid: true })}`
     );
   }
 

@@ -9,7 +9,7 @@
 
 import fs from 'fs/promises';
 import { basename, extname } from 'path';
-import { safeLoad } from 'js-yaml';
+import { load } from 'js-yaml';
 import chalk from 'chalk';
 import { logger } from '../logger';
 import { isPlainObjectType } from './is_plain_object_type';
@@ -43,15 +43,32 @@ async function readFile(filePath: string): Promise<unknown> {
 }
 
 async function readYamlFile(filePath: string): Promise<Record<string, unknown>> {
-  // Typing load's result to Record<string, unknown> is optimistic as we can't be sure
-  // there is object inside a yaml file. We don't have this validation layer so far
-  // but using JSON Schemas here should mitigate this problem.
-  return safeLoad(await fs.readFile(filePath, { encoding: 'utf8' }));
+  const fileContent = await fs.readFile(filePath, { encoding: 'utf8' });
+  const maybeObject = load(fileContent);
+
+  if (!isPlainObjectType(maybeObject)) {
+    throw new Error(
+      `Expected ${chalk.bold(filePath)} to contain an object but got ${typeof maybeObject}`
+    );
+  }
+
+  return maybeObject;
 }
 
 async function readJsonFile(filePath: string): Promise<Record<string, unknown>> {
-  // Typing load's result to Record<string, unknown> is optimistic as we can't be sure
-  // there is object inside a yaml file. We don't have this validation layer so far
-  // but using JSON Schemas here should mitigate this problem.
-  return await JSON.parse(await fs.readFile(filePath, { encoding: 'utf8' }));
+  const fileContent = await fs.readFile(filePath, { encoding: 'utf8' });
+
+  try {
+    const maybeObject = JSON.parse(fileContent);
+
+    if (!isPlainObjectType(maybeObject)) {
+      throw new Error(
+        `Expected ${chalk.bold(filePath)} to contain an object but got ${typeof maybeObject}`
+      );
+    }
+
+    return maybeObject;
+  } catch {
+    throw new Error(`Unable to parse ${chalk.bold(filePath)}`);
+  }
 }
@@ -8,7 +8,7 @@
  */
 
 import fs from 'fs/promises';
-import { safeDump } from 'js-yaml';
+import { dump } from 'js-yaml';
 import { dirname } from 'path';
 
 export async function writeYamlDocument(filePath: string, document: unknown): Promise<void> {
@@ -26,14 +26,14 @@ function stringifyToYaml(document: unknown): string {
   try {
     // Disable YAML Anchors https://yaml.org/spec/1.2.2/#3222-anchors-and-aliases
     // It makes YAML much more human readable
-    return safeDump(document, {
+    return dump(document, {
       noRefs: true,
       sortKeys: sortYamlKeys,
       skipInvalid: true, // Skip invalid types like `undefined`
     });
   } catch (e) {
     // Try to stringify with YAML Anchors enabled
-    return safeDump(document, { noRefs: false, sortKeys: sortYamlKeys, skipInvalid: true });
+    return dump(document, { noRefs: false, sortKeys: sortYamlKeys, skipInvalid: true });
   }
 }
 

@@ -17,7 +17,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from 'fs';
-import { safeDump, safeLoad } from 'js-yaml';
+import { dump, load } from 'js-yaml';
 import { OpenAPIV3 } from 'openapi-types';
 import { bundle, BundlerConfig } from '../../src/openapi_bundler';
 
@@ -59,7 +59,7 @@ function dumpSpecs(folderPath: string, oasSpecs: Record<string, OpenAPIV3.Docume
   for (const [fileName, oasSpec] of Object.entries(oasSpecs)) {
     writeFileSync(
       join(folderPath, `${fileName}.schema.yaml`),
-      safeDump(oasSpec, { skipInvalid: true }) // Skip invalid types like `undefined`
+      dump(oasSpec, { skipInvalid: true }) // Skip invalid types like `undefined`
     );
   }
 }
@@ -70,7 +70,7 @@ export function readBundledSpecs(folderPath: string): Record<string, OpenAPIV3.D
   for (const fileName of readdirSync(folderPath)) {
     const yaml = readFileSync(join(folderPath, fileName), { encoding: 'utf8' });
 
-    bundledSpecs[fileName] = safeLoad(yaml);
+    bundledSpecs[fileName] = load(yaml) as OpenAPIV3.Document;
   }
 
   return bundledSpecs;

@@ -8,7 +8,7 @@
  */
 
 import { readFileSync } from 'fs';
-import { safeLoad } from 'js-yaml';
+import { load } from 'js-yaml';
 import { join } from 'path';
 import { bundleFolder, readBundledSpecs } from './bundle_specs';
 
@@ -26,7 +26,7 @@ describe('OpenAPI Bundler - specs with multiple modifications', () => {
 
     const [bundledSpec] = Object.values(readBundledSpecs(outputFolderPath));
 
-    const expected = safeLoad(
+    const expected = load(
       readFileSync(join(folderToBundlePath, 'expected.yaml'), { encoding: 'utf8' })
     );
 

@@ -7,7 +7,7 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-import { safeDump } from 'js-yaml';
+import { dump } from 'js-yaml';
 import { OpenAPIV3 } from 'openapi-types';
 import { bundleSpecs } from './bundle_specs';
 import { createOASDocument } from '../create_oas_document';
@@ -49,8 +49,7 @@ describe('OpenAPI Bundler - circular specs', () => {
       })
     );
 
-    expect(safeDump(bundledSpec.paths['/api/some_api']!.get!.responses['200']))
-      .toMatchInlineSnapshot(`
+    expect(dump(bundledSpec.paths['/api/some_api']!.get!.responses['200'])).toMatchInlineSnapshot(`
 "content:
   application/json:
     schema: &ref_0

@@ -17,7 +17,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from 'fs';
-import { safeDump, safeLoad } from 'js-yaml';
+import { dump, load } from 'js-yaml';
 import { OpenAPIV3 } from 'openapi-types';
 import { merge, MergerConfig } from '../../src/openapi_merger';
 
@@ -59,7 +59,7 @@ function dumpSpecs(folderPath: string, oasSpecs: Record<string, OpenAPIV3.Docume
   for (const [fileName, oasSpec] of Object.entries(oasSpecs)) {
     writeFileSync(
       join(folderPath, `${fileName}.schema.yaml`),
-      safeDump(oasSpec, { skipInvalid: true })
+      dump(oasSpec, { skipInvalid: true })
     );
   }
 }
@@ -70,7 +70,7 @@ export function readMergedSpecs(folderPath: string): Record<string, OpenAPIV3.Do
   for (const fileName of readdirSync(folderPath)) {
     const yaml = readFileSync(join(folderPath, fileName), { encoding: 'utf8' });
 
-    mergedSpecs[fileName] = safeLoad(yaml);
+    mergedSpecs[fileName] = load(yaml);
   }
 
   return mergedSpecs;

@@ -5,6 +5,6 @@
   },
   "exclude": ["target/**/*"],
   "extends": "../../tsconfig.base.json",
-  "include": ["**/*.ts"],
+  "include": ["**/*.ts", "../../typings/**/*"],
   "kbn_references": ["@kbn/tooling-log"]
 }
@@ -32,7 +32,7 @@ export function readLimits(path: string): Limits {
     }
   }
 
-  return yaml ? Yaml.safeLoad(yaml) : {};
+  return yaml ? Yaml.load(yaml) : {};
 }
 
 export function validateLimitsForAllBundles(
@@ -136,6 +136,6 @@ export function updateBundleLimits({
     pageLoadAssetSize,
   };
 
-  Fs.writeFileSync(limitsPath, Yaml.safeDump(newLimits));
+  Fs.writeFileSync(limitsPath, Yaml.dump(newLimits));
   log.success(`wrote updated limits to ${limitsPath}`);
 }
@@ -8,7 +8,8 @@
     ]
   },
   "include": [
-    "**/*.ts"
+    "**/*.ts",
+    "../../typings/**/*"
   ],
   "exclude": [
     "**/__fixtures__/**/*",