Allow list of classes for SafeConstructor

[Connor Tumbleson]

Hi,

I'm struggling to patch a program for untrusted code being loaded using the non-safe constructor method. I would under impression that I could simply instruct SnakeYAML on allowable classes to resolve after swapping to SafeConstructor.

So that I could allow my classes (MetaInfo, etc), but disallow any rogue attempt to like load `!!javax.script.ScriptEngineManager`

As I dug into more, I became copying lots of code from the base constructor for resolving nodes into class(es). Am I missing something that makes this easier? I've peeked tests and can't quite test, but I was hoping I could do something like.

```
this.yamlClassAllowableEntities.put(MetaInfo.class);
```

Do you have an example that I can follow for allowing specific classes to resolve while working in the SafeConstructor?

[maslovalex]

Maybe you can override

```java

protected Object newInstance(Class<?> ancestor, Node node, boolean tryDefault)

```

and make required checks there.

-Alex

[Connor Tumbleson]

Hi,

Thank you - that worked great.

Connor