opendev
/
irc-meetings
Code Issues Proposed changes

Replaces yaml.load() with yaml.safe_load() 

Yaml.load() return Python object may be dangerous if you receive a YAML
document from an untrusted source such as the Internet. The function
yaml.safe_load() limits this ability to simple Python objects like integers or
lists.

While we're there switch to https for the load so we can be more
confident this is 'correct' data

Reference:
https://security.openstack.org/guidelines/dg_avoid-dangerous-input-parsing-libraries.html

Change-Id: I89adc358f1b3e934788a416b7ef7ea8bfc1a45db
This commit is contained in:
Nguyen Hung Phuong 2018-02-13 14:59:49 +07:00 committed by Tony Breeds
parent e348cb55fa
commit 1134cbcf05
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/list_ptls.py
View File

@ -20,7 +20,7 @@ import textwrap
import requests
import yaml
PROJECTS_LIST = "http://git.openstack.org/cgit/openstack/governance/plain/reference/projects.yaml" # noqa
PROJECTS_LIST = "https://git.openstack.org/cgit/openstack/governance/plain/reference/projects.yaml" # noqa
def main():
@ -44,7 +44,7 @@ def main():
args = parser.parse_args()
r = requests.get(args.project_list)
project_data = yaml.load(r.text)
project_data = yaml.safe_load(r.text)
projects = args.project
if not projects: