Skip to content

Commit 108855c

Browse files
committed
test: eliminate warning re unsafe yaml.load()
Recent pyyaml versions start to warn about using yaml.load(), which is considered unsafe for an arbitrary input (see CVE-2017-18342). Our input is controllable (because we wrote tests ourself), but anyway the warning may be annoying. The main reason for me, however, is that using of yaml.load() is disabled for dev-python/pyyaml package on Gentoo. See [1] for more information. We did the similar changed for tarantool-python, test-run and tarantool tests, see [2], [3], [4], [5]. [1]: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=79ba924d94cb0cf8559565178414c2a1d687b90c [2]: tarantool/tarantool-python@350771d [3]: tarantool/test-run@38400e9 [4]: tarantool/test-run@89808d6 [5]: tarantool/tarantool@d5fdc53
1 parent 300a83e commit 108855c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

lib/tarantool_server.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ def execute_no_reconnect(self, command):
108108
if (res.rfind("\n...\n") >= 0 or res.rfind("\r\n...\r\n") >= 0):
109109
break
110110

111-
return yaml.load(res)
111+
return yaml.safe_load(res)
112112

113113
class TarantoolServer(object):
114114
default_tarantool = {

0 commit comments

Comments
 (0)