use of yaml.load

[trevorgould]

in the generic.py file, the use of yaml.load can be used to arbitrarily execute code, I would recommend switching it to yaml.safe_load. The code in question is as follows.

with open(filename, 'r') as yaml_file:
try:
yaml_content = yaml.load(yaml_file, Loader=yaml.FullLoader)

[marcusbakker]

Hi Trevor,

Thanks for letting us know. I think we already avoid that by specifying the "Loader" with Loader=yaml.FullLoader. Within the documentation on PyYAML the following is stated on that: "Loads the full YAML language. Avoids arbitrary code execution."

• Link to documentation: PyYAML yaml.load(input) Deprecation

Marcus