Right now, stubs can contain contracts in different formats: YAML, Groovy, Java, Kotlin. Of these formats, only one format is "safe to consume": YAML. All the other formats require me to trust the stubs repository contents, as Java, Groovy and Kotlin contracts can execute arbitrary code on the CI server or the developer machine, because they are essentially code, not configuration.
I'd tried to find some combination of dependency exclusions to disable the Java, Groovy and Kotlin parsers, but to no avail. The Kotlin parser is in its own dependency and i can exclude it, but the Java and Groovy parsers are baked into the core.
I'd like to see a configuration option on the consumer side, e.g. formats = { "yaml" } or something like this. This configuration option would then disable contract parsing for all contracts which doesn't match the format - in my example only YAML contracts would be available.
With this configuration option, I don't need to fully trust the stubs repo anymore, as YAML is a configuration format and contains no executable code.
Right now, stubs can contain contracts in different formats: YAML, Groovy, Java, Kotlin. Of these formats, only one format is "safe to consume": YAML. All the other formats require me to trust the stubs repository contents, as Java, Groovy and Kotlin contracts can execute arbitrary code on the CI server or the developer machine, because they are essentially code, not configuration.
I'd tried to find some combination of dependency exclusions to disable the Java, Groovy and Kotlin parsers, but to no avail. The Kotlin parser is in its own dependency and i can exclude it, but the Java and Groovy parsers are baked into the core.
I'd like to see a configuration option on the consumer side, e.g.
formats = { "yaml" }or something like this. This configuration option would then disable contract parsing for all contracts which doesn't match the format - in my example only YAML contracts would be available.With this configuration option, I don't need to fully trust the stubs repo anymore, as YAML is a configuration format and contains no executable code.