openstack/monasca-notification
Code Issues Proposed changes

Replace yaml.load() with yaml.safe_load()

Browse Source 
Avoid dangerous file parsing and object serialization libraries.
yaml.load is the obvious function to use but it is dangerous[1]
Because yaml.load return Python object may be dangerous if you
receive a YAML document from an untrusted source such as the Internet.
The function yaml.safe_load limits this ability to simple Python
objects like integers or lists.

In addition, Bandit flags yaml.load() as security risk so replace
all occurrences with yaml.safe_load(). Thus I replace yaml.load()
with yaml.safe_load()

[1] https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I3f1a756e80b617ba1bcf824ef4dee9a27eb6887a
Closes-Bug: #1634265
This commit is contained in:
Nam Nguyen Hoai 2017-01-18 09:26:49 +07:00
parent 8c504efe04
commit 6f75509f9c
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
monasca_notification/main.py
View File

@ -95,7 +95,7 @@ def main(argv=None):
else: else:
config_file = '/etc/monasca/notification.yaml' config_file = '/etc/monasca/notification.yaml'
config = yaml.load(open(config_file, 'r')) config = yaml.safe_load(open(config_file, 'r'))
# Setup logging # Setup logging
logging.config.dictConfig(config['logging']) logging.config.dictConfig(config['logging'])

2
monasca_notification/plugins/jira_notifier.py
View File

@ -83,7 +83,7 @@ class JiraNotifier(AbstractNotifier):
if (not self.jira_fields_format and self._config.get("custom_formatter")): if (not self.jira_fields_format and self._config.get("custom_formatter")):
try: try:
with open(self._config.get("custom_formatter")) as f: with open(self._config.get("custom_formatter")) as f:
jira_fields_format = yaml.load(f) jira_fields_format = yaml.safe_load(f)
except Exception: except Exception:
self._log.exception("Unable to read custom_formatter file. Check file location") self._log.exception("Unable to read custom_formatter file. Check file location")
raise raise