)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"e6a3ccc4700452be85e0fe336cb2c25115008ec0","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We currently use yaml.load to read a user-written config file. This can"},{"line_number":10,"context_line":"lead to malicious code execution, so we should use yaml.safe_load"},{"line_number":11,"context_line":"instead."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Found using bandit."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3a29b11f_13d603f1","line":11,"updated":"2015-10-22 09:06:58.000000000","message":"Which kinds of syntaxes are allowed by yaml.load() which are not allowed by yaml.safe_load()?\n\nMaybe some users rely on features available in yaml.load() which are not available in yaml.safe_load()?\n\nPyYAML doc says that \"Warning: It is not safe to call yaml.load with any data received from an untrusted source!\" IMHO configuration files are trusted sources, only administrators must be allowed to modify them. Maybe we can just make the bandit warning quiet?\n\nIt would be interesting to run bandit automatically on some Oslo projects. But we must fix bandit warnings before making such check voting ;-)","commit_id":"c4a7ac0b653543e8a3ba10060cabdb114fb6672b"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"f715758aea062f928bc3184104e5cc426b5afded","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"We currently use yaml.load to read a user-written config file. This can"},{"line_number":10,"context_line":"lead to malicious code execution, so we should use yaml.safe_load"},{"line_number":11,"context_line":"instead."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Found using bandit."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3a29b11f_47eb55df","line":11,"in_reply_to":"3a29b11f_13d603f1","updated":"2015-10-22 12:05:33.000000000","message":"yaml.safe_load only understands \"basic\" tags, so the usual \"JSON-like\" things. yaml.load understands stuff like \"dt: !!python/object/apply:time.gmtime []\" and can make function calls.\n\nCan\u0027t a user pass a maliciously crafted config file to oslo.messaging? What if a security issue allows a user to write what they want in the configuration file, and perform a \"rm -rf\" on some important directory they could not delete from their shell?\n\nI don\u0027t really know oslo.messaging and its config files really well, but I think it would be OK to use yaml.safe_load here.","commit_id":"c4a7ac0b653543e8a3ba10060cabdb114fb6672b"}]}