Fix code execution vulnerability by switching to yaml.safe_load

Ref: yaml/pyyaml#5
ypid · Feb 21, 2017 · e0c0845 · e0c0845
1 parent c4c6ce3
commit e0c0845
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/ansiblereview/examples/standards.py b/lib/ansiblereview/examples/standards.py
@@ -34,7 +34,7 @@ def rolesfile_contains_scm_in_src(candidate, settings):
 def files_should_have_actual_content(candidate, settings):
     errors = []
     with codecs.open(candidate.path, mode='rb', encoding='utf-8') as f:
-        content = yaml.load(f.read())
+        content = yaml.safe_load(f.read())
     if not content:
         errors = [Error(None, "%s appears to have no useful content" % candidate)]
     return Result(candidate.path, errors)