Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test pyyaml_4.2 #4285

Merged
merged 4 commits into from Jan 17, 2019

Conversation

Projects
None yet
3 participants
@memsharded
Copy link
Contributor

commented Jan 12, 2019

Changelog: Fix: Using yaml.safe_load instead of load
Docs: Omit

Close #4243

@ghost ghost assigned memsharded Jan 12, 2019

@ghost ghost added the stage: review label Jan 12, 2019

@memsharded memsharded added this to the 1.12 milestone Jan 12, 2019

@memsharded memsharded assigned lasote and unassigned memsharded Jan 16, 2019

@lasote
Copy link
Contributor

left a comment

I've been reading about the security issue with pyyml, it is about the usage of the yaml.load function from untrusted sources. My thoughts:

  • In our codebase, we are parsing files that the user has in his own HDD, so no untrusted parsing.
  • Even though we should be able to replace the three calls with yaml.safe_load()
  • The pyyml project looks surprisingly bad maintained.
  • My opinion, better than trust the beta we should keep the old pyyml version. and dismiss the GH alert. There is a check where you can specify:

image

@ghost ghost assigned memsharded Jan 17, 2019

@lasote

lasote approved these changes Jan 17, 2019

@danimtb

This comment has been minimized.

Copy link
Member

commented Jan 17, 2019

I guess this would need to merge the current changes in develop branch

@lasote

This comment has been minimized.

Copy link
Contributor

commented Jan 17, 2019

It looks like yes. @memsharded

@lasote lasote merged commit af32291 into conan-io:develop Jan 17, 2019

2 checks passed

continuous-integration/jenkins/pr-head This commit looks good
Details
license/cla Contributor License Agreement is signed.
Details

@ghost ghost removed the stage: review label Jan 17, 2019

@memsharded memsharded deleted the memsharded:feature/try_pyyaml_4.2 branch Jan 17, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.