From d629f2f6a58389544440250a5e8cdfcaf3f1e472 Mon Sep 17 00:00:00 2001
From: Alexander Abarca <alexander@variacode.com>
Date: Wed, 12 Jun 2024 10:21:25 -0400
Subject: [PATCH] Added safe constructor to snake yaml object

---
 .../plugins/ansible/plugin/AnsibleResourceModelSource.java   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java b/src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java
index d8d1c82..feb6beb 100644
--- a/src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java
+++ b/src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java
@@ -26,7 +26,9 @@
 import org.rundeck.app.spi.Services;
 import org.rundeck.storage.api.PathUtil;
 import org.rundeck.storage.api.StorageException;
+import org.yaml.snakeyaml.LoaderOptions;
 import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
 import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
@@ -664,7 +666,7 @@ public FileVisitResult postVisitDirectory(Path dir, IOException exc) throws IOEx
    * @throws ResourceModelSourceException
    */
   public void ansibleInventoryList(NodeSetImpl nodes) throws ResourceModelSourceException {
-    Yaml yaml = new Yaml();
+    Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
 
     String listResp = getNodesFromInventory();
 
@@ -709,6 +711,7 @@ public String getNodesFromInventory() {
               .debug(debug);
     }
     AnsibleInventoryList inventoryList = this.ansibleInventoryListBuilder.build();
+    //inventoryList.processVault();
 
     return inventoryList.getNodeList();
   }