Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test pyyaml_4.2 #4285

Merged
merged 4 commits into from Jan 17, 2019
Merged

test pyyaml_4.2 #4285

merged 4 commits into from Jan 17, 2019

Conversation

@memsharded
Copy link
Member

@memsharded memsharded commented Jan 12, 2019

Changelog: Fix: Using yaml.safe_load instead of load
Docs: Omit

Close #4243

@ghost ghost assigned memsharded Jan 12, 2019
@ghost ghost added the stage: review label Jan 12, 2019
@memsharded memsharded added this to the 1.12 milestone Jan 12, 2019
@memsharded memsharded assigned lasote and unassigned memsharded Jan 16, 2019
Copy link
Contributor

@lasote lasote left a comment

I've been reading about the security issue with pyyml, it is about the usage of the yaml.load function from untrusted sources. My thoughts:

  • In our codebase, we are parsing files that the user has in his own HDD, so no untrusted parsing.
  • Even though we should be able to replace the three calls with yaml.safe_load()
  • The pyyml project looks surprisingly bad maintained.
  • My opinion, better than trust the beta we should keep the old pyyml version. and dismiss the GH alert. There is a check where you can specify:

image

@ghost ghost assigned memsharded Jan 17, 2019
lasote
lasote approved these changes Jan 17, 2019
@danimtb
Copy link
Member

@danimtb danimtb commented Jan 17, 2019

I guess this would need to merge the current changes in develop branch

@lasote
Copy link
Contributor

@lasote lasote commented Jan 17, 2019

It looks like yes. @memsharded

@lasote lasote merged commit af32291 into conan-io:develop Jan 17, 2019
2 checks passed
@ghost ghost removed the stage: review label Jan 17, 2019
@memsharded memsharded deleted the feature/try_pyyaml_4.2 branch Jan 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants