Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

test pyyaml_4.2 #4285

Merged
merged 4 commits into from
Jan 17, 2019
Merged

test pyyaml_4.2 #4285

merged 4 commits into from
Jan 17, 2019

Conversation

memsharded
Copy link
Member

@memsharded memsharded commented Jan 12, 2019 •
edited
Loading

Changelog: Fix: Using yaml.safe_load instead of load
Docs: Omit

Close #4243

@ghost ghost assigned memsharded Jan 12, 2019
@ghost ghost added the stage: review label Jan 12, 2019
@memsharded memsharded added this to the 1.12 milestone Jan 12, 2019
@memsharded memsharded assigned lasote and unassigned memsharded Jan 16, 2019
lasote
lasote suggested changes Jan 17, 2019
View reviewed changes
Copy link
Contributor

@lasote lasote left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've been reading about the security issue with pyyml, it is about the usage of the yaml.load function from untrusted sources. My thoughts:

  • In our codebase, we are parsing files that the user has in his own HDD, so no untrusted parsing.
  • Even though we should be able to replace the three calls with yaml.safe_load()
  • The pyyml project looks surprisingly bad maintained.
  • My opinion, better than trust the beta we should keep the old pyyml version. and dismiss the GH alert. There is a check where you can specify:

image

@ghost ghost assigned memsharded Jan 17, 2019
@danimtb
Copy link
Member

danimtb commented Jan 17, 2019

I guess this would need to merge the current changes in develop branch

@lasote
Copy link
Contributor

lasote commented Jan 17, 2019

It looks like yes. @memsharded

@lasote lasote merged commit af32291 into conan-io:develop Jan 17, 2019
@ghost ghost removed the stage: review label Jan 17, 2019
@memsharded memsharded deleted the feature/try_pyyaml_4.2 branch January 17, 2019 11:50
@ketzu ketzu mentioned this pull request Apr 10, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lasote lasote lasote approved these changes

Assignees

@lasote lasote

@memsharded memsharded

Labels
None yet
Projects
None yet
Milestone
1.12
Development

Successfully merging this pull request may close these issues.
3 participants
@memsharded @danimtb @lasote