Skip to content
This repository has been archived by the owner on Jan 14, 2020. It is now read-only.

Commit

Permalink
Prevent remote code execution
Browse files Browse the repository at this point in the history
yaml.load() allows the provider of the yaml data (in this case: the monitored
host) to run arbitrary commands.
  • Loading branch information
Stefan Nordhausen committed Jan 16, 2017
1 parent c7aa6c7 commit 2191fe6
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ def get_from_header(field):
return response.headers[field] if field in response.headers else None

if response.status_code == 200:
yaml_config = yaml.load(response.content)
yaml_config = yaml.safe_load(response.content)
etag = get_from_header('etag')
mtime = get_from_header('last-modified')
mtime = datetime.datetime.strptime(mtime, '%a, %d %b %Y %H:%M:%S %Z').strftime('%s') if mtime else int(time())
Expand Down

0 comments on commit 2191fe6

Please sign in to comment.