fix: use safe_load for parsing yaml

(closes #464)

Author: jirikuncar

renku/api/datasets.py

@@ -78,7 +78,7 @@ def with_dataset(self, name=None):
 
                 if path.exists():
                     with path.open('r') as f:
-                        source = yaml.load(f) or {}
+                        source = yaml.safe_load(f) or {}
                     dataset = Dataset.from_jsonld(source, __reference__=path)
 
             if dataset is None:

renku/api/repository.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright 2018 - Swiss Data Science Center (SDSC)
+# Copyright 2018-2019 - Swiss Data Science Center (SDSC)
 # A partnership between École Polytechnique Fédérale de Lausanne (EPFL) and
 # Eidgenössische Technische Hochschule Zürich (ETHZ).
 #
@@ -191,7 +191,7 @@ def process_commit(self, commit=None, path=None):
         if path:
             data = (commit.tree / path).data_stream.read()
             process = CWLClass.from_cwl(
-                yaml.load(data), __reference__=Path(path)
+                yaml.safe_load(data), __reference__=Path(path)
             )
 
             return process.create_run(
@@ -294,7 +294,7 @@ def with_metadata(self):
 
             if self.renku_metadata_path.exists():
                 with metadata_path.open('r') as f:
-                    source = yaml.load(f) or {}
+                    source = yaml.safe_load(f) or {}
             else:
                 source = {}
 

renku/cli/_config.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright 2017 - Swiss Data Science Center (SDSC)
+# Copyright 2017-2019 - Swiss Data Science Center (SDSC)
 # A partnership between École Polytechnique Fédérale de Lausanne (EPFL) and
 # Eidgenössische Technische Hochschule Zürich (ETHZ).
 #
@@ -64,7 +64,7 @@ def read_config(path=None, final=False):
     """Read Renku configuration."""
     try:
         with open(config_path(path, final=final), 'r') as configfile:
-            return yaml.load(configfile) or {}
+            return yaml.safe_load(configfile) or {}
     except FileNotFoundError:
         return {}
 

renku/cli/migrate.py

@@ -44,7 +44,7 @@ def datasets(ctx, client):
     with client.lock:
         for old_path in _dataset_metadata_pre_0_3_4(client):
             with old_path.open('r') as fp:
-                dataset = Dataset.from_jsonld(yaml.load(fp))
+                dataset = Dataset.from_jsonld(yaml.safe_load(fp))
 
             name = str(old_path.parent.relative_to(client.path / 'data'))
             new_path = (

renku/cli/runner.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 #
-# Copyright 2018 - Swiss Data Science Center (SDSC)
+# Copyright 2018-2019 - Swiss Data Science Center (SDSC)
 # A partnership between École Polytechnique Fédérale de Lausanne (EPFL) and
 # Eidgenössische Technische Hochschule Zürich (ETHZ).
 #
@@ -92,7 +92,7 @@ def rerun(client, run, job):
             args.append(job_file.name)
 
             with job_file as fp:
-                yaml.dump(yaml.load(job), stream=fp, encoding='utf-8')
+                yaml.dump(yaml.safe_load(job), stream=fp, encoding='utf-8')
 
         if run:
             return call(args, cwd=os.getcwd())

renku/models/_jsonld.py

@@ -356,7 +356,9 @@ def from_yaml(cls, path):
         import yaml
 
         with path.open(mode='r') as fp:
-            self = cls.from_jsonld(yaml.load(fp) or {}, __reference__=path)
+            self = cls.from_jsonld(
+                yaml.safe_load(fp) or {}, __reference__=path
+            )
 
         return self
 

renku/models/cwl/_ascwl.py

@@ -66,7 +66,7 @@ def from_yaml(cls, path):
         import yaml
 
         with path.open(mode='r') as fp:
-            self = cls.from_cwl(yaml.load(fp), __reference__=path)
+            self = cls.from_cwl(yaml.safe_load(fp), __reference__=path)
 
         return self
 

renku/models/provenance/activities.py

@@ -413,7 +413,7 @@ def _load(step):
                 import yaml
                 data = (self.commit.tree / basedir /
                         step.run).data_stream.read()
-                return CWLClass.from_cwl(yaml.load(data))
+                return CWLClass.from_cwl(yaml.safe_load(data))
 
             return CWLClass.from_yaml(step.run)
 

tests/cli/test_output_option.py

@@ -35,7 +35,7 @@ def test_without_an_output_option(runner, client, run):
     cwls = []
     for tool_path in tools:
         with tool_path.open('r') as f:
-            cwls.append(CWLClass.from_cwl(yaml.load(f)))
+            cwls.append(CWLClass.from_cwl(yaml.safe_load(f)))
 
     assert cwls[0].inputs != cwls[1].inputs
     assert cwls[0].outputs != cwls[1].outputs
@@ -55,7 +55,7 @@ def test_with_an_output_option(runner, client, run):
     cwls = []
     for tool_path in tools:
         with tool_path.open('r') as f:
-            cwls.append(CWLClass.from_cwl(yaml.load(f)))
+            cwls.append(CWLClass.from_cwl(yaml.safe_load(f)))
 
     assert cwls[0].inputs == cwls[1].inputs
     assert cwls[0].outputs == cwls[1].outputs
@@ -79,7 +79,7 @@ def test_output_directory_with_output_option(runner, client, run):
     cwls = []
     for tool_path in tools:
         with tool_path.open('r') as f:
-            cwls.append(CWLClass.from_cwl(yaml.load(f)))
+            cwls.append(CWLClass.from_cwl(yaml.safe_load(f)))
 
     assert cwls[0].inputs != cwls[1].inputs
     assert cwls[0].outputs != cwls[1].outputs
@@ -107,7 +107,7 @@ def test_output_directory_without_separate_outputs(runner, client, run):
     assert 1 == len(tools)
 
     with tools[0].open('r') as f:
-        cwl = CWLClass.from_cwl(yaml.load(f))
+        cwl = CWLClass.from_cwl(yaml.safe_load(f))
 
     assert 1 == len(cwl.outputs)
     assert 'Directory' == cwl.outputs[0].type

tests/test_cli.py

@@ -173,7 +173,7 @@ def test_workflow(runner, project):
     assert result.exit_code == 0
 
     with open('workflow.cwl', 'r') as f:
-        workflow = Workflow.from_cwl(yaml.load(f))
+        workflow = Workflow.from_cwl(yaml.safe_load(f))
         assert workflow.steps[0].run.startswith('.renku/workflow/')
 
     # Compare default log and log for a specific file.
@@ -627,7 +627,7 @@ def test_modified_tool(runner, project, run):
 
     tool_path = tools[0]
     with tool_path.open('r') as f:
-        command_line_tool = CWLClass.from_cwl(yaml.load(f))
+        command_line_tool = CWLClass.from_cwl(yaml.safe_load(f))
 
     # Simulate a manual edit.
     command_line_tool.inputs[0].default = 'ahoj'