Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use yaml.safe_load() and yaml.safe_dump() #58

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Use yaml.safe_load() and yaml.safe_dump() #58

wants to merge 2 commits into from

Commits on Jul 17, 2019

  1. Use yaml.safe_load() instead of yaml.load() 

    Gentoo has disabled yaml.load() in response to CVE-2017-18342, see
https://bugs.gentoo.org/659348 for more details.  This results in clay
being unusabel on Gentoo systems, as loading the settings YAML causes
the application to fail.

This patch changes the yaml.load() calls to yaml.safe_load(), which
avoids the security issue and has been left enabled by Gentoo.

Signed-off-by: Palmer Dabbelt <palmer@dabbelt.com>
    @palmer-dabbelt
    palmer-dabbelt committed Jul 17, 2019
    Configuration menu
    Copy the full SHA
    7283f01 View commit details
    Browse the repository at this point in the history

  2. Use yaml.safe_dump() intsead of yaml.dump() 

    yaml.dump() is capable of producing files that cannot be read by
yaml.load(), which would result in the application being unable to load
the settings file.  I haven't actually seen this happen, I just noticed
safe_dump() when doing the safe_load() change.

Signed-off-by: Palmer Dabbelt <palmer@dabbelt.com>
    @palmer-dabbelt
    palmer-dabbelt committed Jul 17, 2019
    Configuration menu
    Copy the full SHA
    6fa517e View commit details
    Browse the repository at this point in the history