commit 0939e815f97e5e2df43ef3660308cddcd560ab3c
Author: Luong Anh Tuan <email address hidden>
Date: Wed Jan 18 13:12:35 2017 +0700
Replace yaml.load() with yaml.safe_load()
Avoid dangerous file parsing and object serialization libraries.
yaml.load is the obvious function to use but it is dangerous[1]
Because yaml.load return Python object may be dangerous if you
receive a YAML document from an untrusted source such as the
Internet. The function yaml.safe_load limits this ability to
simple Python objects like integers or lists.
In addition, Bandit flags yaml.load() as security risk so replace
all occurrences with yaml.safe_load(). Thus I replace yaml.load()
with yaml.safe_load()
Reviewed: https:/ /review. openstack. org/421681 /git.openstack. org/cgit/ openstack/ sahara- tests/commit/ ?id=0939e815f97 e5e2df43ef36603 08cddcd560ab3c
Committed: https:/
Submitter: Jenkins
Branch: master
commit 0939e815f97e5e2 df43ef3660308cd dcd560ab3c
Author: Luong Anh Tuan <email address hidden>
Date: Wed Jan 18 13:12:35 2017 +0700
Replace yaml.load() with yaml.safe_load()
Avoid dangerous file parsing and object serialization libraries.
yaml.load is the obvious function to use but it is dangerous[1]
Because yaml.load return Python object may be dangerous if you
receive a YAML document from an untrusted source such as the
Internet. The function yaml.safe_load limits this ability to
simple Python objects like integers or lists.
In addition, Bandit flags yaml.load() as security risk so replace
all occurrences with yaml.safe_load(). Thus I replace yaml.load()
with yaml.safe_load()
[1]https:/ /security. openstack. org/guidelines/ dg_avoid- dangerous- input-parsing- libraries. html
Change-Id: I7e440eda0ba0e5 f66c88b418112d4 8a9b4b0b84d
Closes-Bug: #1634265