Merge pull request #17 from ypid/fix/code_execution_vulnerability

Fix code execution vulnerability by switching to yaml.safe_load
willthames · Feb 22, 2017 · 484141f · 484141f
2 parents c4c6ce3 + e0c0845
commit 484141f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/ansiblereview/examples/standards.py b/lib/ansiblereview/examples/standards.py
@@ -34,7 +34,7 @@ def rolesfile_contains_scm_in_src(candidate, settings):
 def files_should_have_actual_content(candidate, settings):
     errors = []
     with codecs.open(candidate.path, mode='rb', encoding='utf-8') as f:
-        content = yaml.load(f.read())
+        content = yaml.safe_load(f.read())
     if not content:
         errors = [Error(None, "%s appears to have no useful content" % candidate)]
     return Result(candidate.path, errors)