Merge pull request #91 from Teamwork/fix/yaml-security-fix

Fix: Upgrade gopkg.in/yaml.v2 to gopkg.in/yaml.v3 due to security issue

docparse/jsonschema.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/teamwork/utils/goutil"
 	"github.com/teamwork/utils/sliceutil"
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 // The Schema Object allows the definition of input and output data types.

go.mod

@@ -4,10 +4,10 @@ go 1.12
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/imdario/mergo v0.3.7
+	github.com/imdario/mergo v0.3.13
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/teamwork/test v0.0.0-20181126061546-2ff8918eb6a4
 	github.com/teamwork/utils v0.0.0-20190114034940-d6a1f27ce92c
-	gopkg.in/yaml.v2 v2.2.2
+	gopkg.in/yaml.v3 v3.0.1
 	zgo.at/sconfig v1.2.2-0.20211017232425-870f818a71b7
 )

go.sum

@@ -1,9 +1,7 @@
-arp242.net/sconfig v0.0.0-20180901013357-c014d3b7a101 h1:V6CYq+es2ncUeJ2jzJxWVviAs7iNW/jvPb4+3LHOXsE=
-arp242.net/sconfig v0.0.0-20180901013357-c014d3b7a101/go.mod h1:s7teWAlHUlC2xRICC2FKERk6kQBI9lREHKRfWIWF+lA=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/imdario/mergo v0.3.7 h1:Y+UAYTZ7gDEuOfhxKWy+dvb5dRQ6rJjFSdX2HZY1/gI=
-github.com/imdario/mergo v0.3.7/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/teamwork/test v0.0.0-20181126061546-2ff8918eb6a4 h1:/ujiGN1Gf1yBNvRoXSn/c24mbyjQN+r3nXOKLXfUt+A=
@@ -12,7 +10,8 @@ github.com/teamwork/utils v0.0.0-20190114034940-d6a1f27ce92c h1:5/hkqtufOyLP25ta
 github.com/teamwork/utils v0.0.0-20190114034940-d6a1f27ce92c/go.mod h1:rmPaJUVv426LGg3QR31m1N0bfpCdCVyh3dCWsJTQeDA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 zgo.at/sconfig v1.2.2-0.20211017232425-870f818a71b7 h1:fw2yuIGMHzSRYrZUVOt/c1O/igkJIXorj/FNCg+tg2E=
 zgo.at/sconfig v1.2.2-0.20211017232425-870f818a71b7/go.mod h1:RXEBQABoIc7RnagqaT+7BHU81g1okqSLeND/YJLZiDE=

html/html.go

@@ -9,7 +9,7 @@ import (
 	"os"
 
 	"github.com/teamwork/kommentaar/docparse"
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 var funcMap = template.FuncMap{

openapi2/openapi2.go

@@ -5,6 +5,7 @@
 package openapi2 // import "github.com/teamwork/kommentaar/openapi2"
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -14,7 +15,7 @@ import (
 	"github.com/imdario/mergo"
 	"github.com/teamwork/kommentaar/docparse"
 	"github.com/teamwork/utils/goutil"
-	yaml "gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v3"
 )
 
 type (
@@ -469,7 +470,11 @@ func write(outFormat string, w io.Writer, prog *docparse.Program) error {
 	case "json":
 		d, err = json.Marshal(&out)
 	case "yaml":
-		d, err = yaml.Marshal(&out)
+		var b bytes.Buffer
+		yamlEncoder := yaml.NewEncoder(&b)
+		yamlEncoder.SetIndent(2)
+		err = yamlEncoder.Encode(&out)
+		d = b.Bytes()
 	default:
 		err = fmt.Errorf("unknown format: %#v", outFormat)
 	}

testdata/openapi2/src/blank-line/want.yaml

@@ -3,21 +3,21 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 tags:
-- name: tag
+  - name: tag
 paths:
   /path:
     post:
       operationId: POST_path
       tags:
-      - tag
+        - tag
       consumes:
-      - application/x-www-form-urlencoded
+        - application/x-www-form-urlencoded
       produces:
-      - application/json
+        - application/json
       responses:
         200:
           description: 200 OK (no data)

testdata/openapi2/src/description-print-var/want.yaml

@@ -3,9 +3,9 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 paths:
   /path:
     post:
@@ -39,7 +39,7 @@ paths:
 
         I'm escaped $foo
       produces:
-      - application/json
+        - application/json
       responses:
         200:
           description: 200 OK (no data)

testdata/openapi2/src/embedded-pointer/want.yaml

@@ -3,15 +3,15 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 paths:
   /path:
     post:
       operationId: POST_path
       produces:
-      - application/json
+        - application/json
       responses:
         200:
           description: 200 OK

testdata/openapi2/src/embedded-sometimes/want.yaml

@@ -3,31 +3,31 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 tags:
-- name: foobar
+  - name: foobar
 paths:
   /foo/{id}:
     post:
       operationId: POST_foo_{id}
       tags:
-      - foobar
+        - foobar
       consumes:
-      - application/json
+        - application/json
       produces:
-      - application/json
+        - application/json
       parameters:
-      - name: id
-        in: path
-        type: integer
-        required: true
-      - name: embedded-sometimes.RequestObj
-        in: body
-        required: true
-        schema:
-          $ref: '#/definitions/embedded-sometimes.RequestObj'
+        - name: id
+          in: path
+          type: integer
+          required: true
+        - name: embedded-sometimes.RequestObj
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/embedded-sometimes.RequestObj'
       responses:
         200:
           description: 200 OK

testdata/openapi2/src/endpoint-extend/want.yaml

@@ -3,23 +3,23 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 paths:
   /path:
     post:
       consumes:
-      - application/xml
+        - application/xml
       operationId: POST_path
       parameters:
-      - in: body
-        name: endpoint-extend.reqRef
-        required: true
-        schema:
-          $ref: '#/definitions/endpoint-extend.reqRef'
+        - in: body
+          name: endpoint-extend.reqRef
+          required: true
+          schema:
+            $ref: '#/definitions/endpoint-extend.reqRef'
       produces:
-      - application/json
+        - application/json
       responses:
         "200":
           description: 200 OK (no data)

testdata/openapi2/src/export/want.yaml

@@ -3,26 +3,26 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 paths:
   /path:
     post:
       operationId: POST_path
       consumes:
-      - application/json
+        - application/json
       produces:
-      - application/json
+        - application/json
       parameters:
-      - name: exported
-        in: query
-        type: string
-      - name: export.ref2
-        in: body
-        required: true
-        schema:
-          $ref: '#/definitions/export.ref2'
+        - name: exported
+          in: query
+          type: string
+        - name: export.ref2
+          in: body
+          required: true
+          schema:
+            $ref: '#/definitions/export.ref2'
       responses:
         200:
           description: 200 OK (no data)

testdata/openapi2/src/field-whitelist/want.yaml

@@ -3,15 +3,15 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 paths:
   /path:
     post:
       operationId: POST_path
       produces:
-      - application/json
+        - application/json
       responses:
         200:
           description: 200 OK

testdata/openapi2/src/interface/want.yaml

@@ -3,15 +3,15 @@ info:
   title: x
   version: x
 consumes:
-- application/json
+  - application/json
 produces:
-- application/json
+  - application/json
 paths:
   /path:
     get:
       operationId: GET_path
       produces:
-      - application/json
+        - application/json
       responses:
         200:
           description: 200 OK