)]}'
{"id":"openstack%2Fmistral~1001622","triplet_id":"openstack%2Fmistral~master~Ibe838f4c5f3edb73c366e850117a6bd40b44a89e","project":"openstack/mistral","branch":"master","hashtags":[],"change_id":"Ibe838f4c5f3edb73c366e850117a6bd40b44a89e","subject":"Route yaml_parse through the anchor-hardened YAML loader","status":"MERGED","created":"2026-08-20 07:24:12.000000000","updated":"2026-08-20 10:40:12.000000000","submitted":"2026-08-20 10:38:50.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1001622","meta_rev_id":"576307a94b2591d4a630d2b7f0743780085d246a","_number":1001622,"virtual_id_number":1001622,"owner":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-20 10:38:50.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-08-20 09:50:40.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"all":[{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2026-08-20 09:50:40.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-20 08:10:43.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"cdacd8465a7db86bc75a42212139fc06ce37fda9","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-08-20 07:24:12.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"eee01708c5b5b3c7ff742250ca9aa17988295587","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-20 08:10:43.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/dddb22bd072640dd8d07a8ee276d7300\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9b7b309f441545b9867f4019146173ac : SUCCESS in 3m 57s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7cf08f79e0584674bc989cee41e6dbbd : SUCCESS in 11m 06s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/98464645617d415c85f74029354ca004 : SUCCESS in 8m 42s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/61909afe15f14209a38bc9bc4faa639f : SUCCESS in 11m 34s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/71c3086d10914ed29a1788d9ff3969a5 : SUCCESS in 7m 53s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/5242479df0d345c4bda335ca134d628e : SUCCESS in 4m 06s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ae54bdd4bd1a47efb36ce500d3fb5a61 : SUCCESS in 15m 41s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/7d942f4a047147a1ae74ee23fa0ebbb2 : SUCCESS in 40m 48s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/c41806a138d541c2a55c0cb33eacd881 : SUCCESS in 40m 40s","accounts_in_message":[],"_revision_number":1},{"id":"8a328b13c627838f33ea9578ef5b383f4bf4aaeb","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-08-20 08:34:31.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased. Commit message was updated.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"cc37d689a58a0300e850161b8f06a6ee1c5d6746","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-20 09:24:31.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f84b5472da044c15a793d7d7fdd8f611\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4d3cfa7159b34dd8b07f64d953123e2e : SUCCESS in 2m 40s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/cc4eccd0db3943f4ab0dc94d4c762680 : SUCCESS in 11m 04s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0eae266f9a7046e0b78ced1e7f27dacc : SUCCESS in 11m 11s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/3ea7acb1aea44ed8b00314f525aba0d2 : SUCCESS in 13m 01s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/685c92d004474813a6f7a750c4911859 : SUCCESS in 8m 35s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/aa0d0aee0dbf4996bd8700b8e623247a : SUCCESS in 4m 48s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/e7b40485597243d68715fd6eedb66d77 : SUCCESS in 13m 44s (non-voting)\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/c0644d88709c40e8b4fb971163dee151 : SUCCESS in 29m 33s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e08b75246bd041488d7965ce602a9be9 : SUCCESS in 44m 21s","accounts_in_message":[],"_revision_number":2},{"id":"75706309b4d21cee09a02d6e91f4e873005d15dd","author":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"date":"2026-08-20 09:50:40.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"356161740bc279f75a5ae27012a4ce232334ee77","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-20 09:51:13.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"3c795287cd52b5830f5384dc9a93d359f14add55","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-20 10:38:50.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f620432d7ffb4ba2a94f32f724bfe694\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d5cf309c7cf249cabb71920fc57bb43c : SUCCESS in 3m 40s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/79b7498f8dfb4ee3a6b5921ff028f13a : SUCCESS in 9m 55s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0782b89f6951453da41399e6e1cf3382 : SUCCESS in 9m 57s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/4cd9d74a4ffa40bc8db8d1308cccfd09 : SUCCESS in 8m 52s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/571e0f2a6cfd4e78ae42ed54b754e903 : SUCCESS in 4m 43s\n- mistral-devstack https://zuul.opendev.org/t/openstack/build/04144c9c54f240c8a699ad39ebd4df28 : SUCCESS in 42m 22s\n- mistral-devstack-tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/1f0bd7d8dd024856aef25bba6d9b5ef1 : SUCCESS in 19m 17s","accounts_in_message":[],"_revision_number":2},{"id":"1609cb28c6e7e377180f39928fd3d29882a2e972","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-20 10:38:50.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"576307a94b2591d4a630d2b7f0743780085d246a","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-20 10:40:12.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f6fe7bc8b5534ce2ad6c18cc7de8495a\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f40080f37ff74029b778e5969643e3fc : SUCCESS in 53s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/941740bf397a478c81abffff9b27953d : SUCCESS in 56s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"9fbda407a1c76cf0ae02a2d394814cabebab59fc","revisions":{"31c724a1543e3fd47a4d5de638a53c55f96ef831":{"kind":"REWORK","_number":1,"created":"2026-08-20 07:24:12.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/22/1001622/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/22/1001622/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/22/1001622/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/22/1001622/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/22/1001622/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/22/1001622/1"}}},"commit":{"parents":[{"commit":"5f8ff908a408fd2c7ad14d00adae5e0769ab3574","subject":"Allow operators to disable expression languages","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/5f8ff908a408fd2c7ad14d00adae5e0769ab3574"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-19 22:48:39.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-20 07:23:39.000000000","tz":120},"subject":"Route yaml_parse through the anchor-hardened YAML loader","message":"Route yaml_parse through the anchor-hardened YAML loader\n\nThe yaml_parse expression function called the plain yaml.safe_load,\nwhose SafeLoader resolves YAML anchors and aliases and is therefore\nvulnerable to the \"billion laughs\" entity-expansion DoS. Unlike the\nworkflow-definition parse paths, which already route through\nmistral.utils.safe_yaml (a SafeLoader that neutralizes anchors),\nyaml_parse did not - and it is reachable from any YAQL/Jinja\nexpression with attacker-controlled input (e.g. yaml_parse($.payload)\nwhere payload is workflow input), so a normal authenticated tenant\ncould OOM the shared engine for all tenants.\n\nUse safe_yaml.load in yaml_parse and safe_yaml.safe_dump in yaml_dump.\n\nRelated-Bug: #1680117\nGenerated-By: Claude Fable 5 (Anthropic AI assistant)\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Ibe838f4c5f3edb73c366e850117a6bd40b44a89e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/31c724a1543e3fd47a4d5de638a53c55f96ef831"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/31c724a1543e3fd47a4d5de638a53c55f96ef831"}]},"branch":"refs/heads/master"},"9fbda407a1c76cf0ae02a2d394814cabebab59fc":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":2,"created":"2026-08-20 08:34:31.000000000","uploader":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"},"ref":"refs/changes/22/1001622/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/mistral","ref":"refs/changes/22/1001622/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/mistral refs/changes/22/1001622/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/mistral refs/changes/22/1001622/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/mistral refs/changes/22/1001622/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/mistral refs/changes/22/1001622/2"}}},"commit":{"parents":[{"commit":"6d7b8c3afdca60d33e68fbf089bcbee92d78f124","subject":"Allow operators to disable expression languages","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/6d7b8c3afdca60d33e68fbf089bcbee92d78f124"}]}],"author":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-20 08:31:31.000000000","tz":120},"committer":{"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","date":"2026-08-20 08:31:31.000000000","tz":120},"subject":"Route yaml_parse through the anchor-hardened YAML loader","message":"Route yaml_parse through the anchor-hardened YAML loader\n\nThe yaml_parse expression function called the plain yaml.safe_load,\nwhose SafeLoader resolves YAML anchors and aliases and is therefore\nvulnerable to the \"billion laughs\" entity-expansion DoS. Unlike the\nworkflow-definition parse paths, which already route through\nmistral.utils.safe_yaml (a SafeLoader that neutralizes anchors),\nyaml_parse did not - and it is reachable from any YAQL/Jinja\nexpression with attacker-controlled input (e.g. yaml_parse($.payload)\nwhere payload is workflow input), so a normal authenticated tenant\ncould OOM the shared engine for all tenants.\n\nUse safe_yaml.load in yaml_parse and safe_yaml.safe_dump in yaml_dump.\n\nRelated-Bug: #1680117\nGenerated-By: Claude Fable 5 (Anthropic AI assistant)\nSigned-off-by: Arnaud Morin \u003carnaud.morin@gmail.com\u003e\nChange-Id: Ibe838f4c5f3edb73c366e850117a6bd40b44a89e\n\n\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/9fbda407a1c76cf0ae02a2d394814cabebab59fc"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/mistral/commit/9fbda407a1c76cf0ae02a2d394814cabebab59fc"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":11583,"name":"Arnaud Morin","email":"arnaud.morin@gmail.com","username":"arnaudmorin"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}