commit d8df4ddfb10a9213e524ee25d14f271b7a4af727
author Bo Wang <bo.wang@easystack.cn> Tue Feb 16 21:23:53 2016 +0800
committer Bo Wang <bo.wang@easystack.cn> Tue Feb 16 21:37:27 2016 +0800
tree ce8d02eb6211cfcf52126ac01d7ce5b5493067c4
parent b95d7b5f22a7ac691da0da7652dcb29e8c9be3b7

Use yaml.safe_load() instead of yaml.load()

yaml.load() provides the ability to construct an arbitrary python object
that may be dangerous. yaml.safe_load() limits this ability to simple
python objects like integers or lists.

ref: https://en.wikipedia.org/wiki/YAML#Security

Change-Id: I9c28c25f4265fb691d39e72e20ef9c99f5538bf5

functional/test_aws_stack.py

diff --git a/functional/test_aws_stack.py b/functional/test_aws_stack.py
index 678ce7e..5fbe24f 100644
--- a/functional/test_aws_stack.py
+++ b/functional/test_aws_stack.py
@@ -115,7 +115,7 @@
     def test_nested_stack_create_with_timeout(self):
         url = self.publish_template(self.nested_template)
         self.template = self.test_template.replace('the.yaml', url)
-        timeout_template = yaml.load(self.template)
+        timeout_template = yaml.safe_load(self.template)
         props = timeout_template['Resources']['the_nested']['Properties']
         props['TimeoutInMinutes'] = '50'
 
@@ -142,7 +142,7 @@
                 }
             },
             "environment": {"parameters": {}},
-            "template": yaml.load(self.template)
+            "template": yaml.safe_load(self.template)
         }
 
         stack_identifier = self.stack_adopt(adopt_data=json.dumps(adopt_data))
@@ -163,7 +163,7 @@
                 }
             },
             "environment": {"parameters": {}},
-            "template": yaml.load(self.template)
+            "template": yaml.safe_load(self.template)
         }
 
         stack_identifier = self.stack_adopt(adopt_data=json.dumps(adopt_data),
@@ -180,7 +180,7 @@
         stack = self.client.stacks.get(stack_identifier)
         self.assertEqual('bar', self._stack_output(stack, 'output_foo'))
 
-        new_template = yaml.load(self.template)
+        new_template = yaml.safe_load(self.template)
         props = new_template['Resources']['the_nested']['Properties']
         props['TemplateURL'] = self.publish_template(self.update_template,
                                                      cleanup=False)