openstack/keystoneauth
Code Issues Proposed changes

Replace yaml.load() with yaml.safe_load()

Browse Source 
Avoid dangerous file parsing and object serialization libraries.
yaml.load is the obvious function to use but it is dangerous[1]
Because yaml.load return Python object may be dangerous if you
receive a YAML document from an untrusted source such as the
Internet. The function yaml.safe_load limits this ability to
simple Python objects like integers or lists.

In addition, Bandit flags yaml.load() as security risk so replace
all occurrences with yaml.safe_load(). Thus I replace yaml.load()
with yaml.safe_load()

[1]https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: Ia45006ce1382022e5c776d06fdc3c33e9b4d8c47
Closes-Bug: #1634265
This commit is contained in:
Luong Anh Tuan 2017-01-16 15:33:56 +07:00
parent 06e0aeb8f1
commit 7e11cab57b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
keystoneauth1/tests/unit/test_betamax_serializer.py
View File

@ -44,7 +44,7 @@ class TestBetamaxSerializer(testtools.TestCase):
def test_serialize(self): def test_serialize(self):
data = json.loads(open(self.TEST_JSON, 'r').read()) data = json.loads(open(self.TEST_JSON, 'r').read())
serialized = self.serializer.serialize(data) serialized = self.serializer.serialize(data)
data = yaml.load(serialized) data = yaml.safe_load(serialized)
request = data['http_interactions'][0]['request'] request = data['http_interactions'][0]['request']
self.assertEqual( self.assertEqual(
'http://keystoneauth-betamax.test/v2.0/tokens', 'http://keystoneauth-betamax.test/v2.0/tokens',