Comment 21 for bug 1634265

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to sahara-tests (master)

Reviewed: https://review.openstack.org/421681
Committed: https://git.openstack.org/cgit/openstack/sahara-tests/commit/?id=0939e815f97e5e2df43ef3660308cddcd560ab3c
Submitter: Jenkins
Branch: master

commit 0939e815f97e5e2df43ef3660308cddcd560ab3c
Author: Luong Anh Tuan <email address hidden>
Date: Wed Jan 18 13:12:35 2017 +0700

    Replace yaml.load() with yaml.safe_load()

    Avoid dangerous file parsing and object serialization libraries.
    yaml.load is the obvious function to use but it is dangerous[1]
    Because yaml.load return Python object may be dangerous if you
    receive a YAML document from an untrusted source such as the
    Internet. The function yaml.safe_load limits this ability to
    simple Python objects like integers or lists.

    In addition, Bandit flags yaml.load() as security risk so replace
    all occurrences with yaml.safe_load(). Thus I replace yaml.load()
    with yaml.safe_load()

    [1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

    Change-Id: I7e440eda0ba0e5f66c88b418112d48a9b4b0b84d
    Closes-Bug: #1634265