From ec15a221d60ab374045ecc3bb4f2e47d28beccc4 Mon Sep 17 00:00:00 2001 From: Daniel Schultz Date: Tue, 5 Jan 2021 23:36:24 +0100 Subject: [PATCH] utils: xyaml: Do not use deprecated function From the official PyYAML documentation: "Warning: It is not safe to call yaml.load with any data received from an untrusted source! yaml.load is as powerful as pickle.load and so may call any Python function. Check the yaml.safe_load function though." Signed-off-by: Daniel Schultz --- utils/xyaml.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/utils/xyaml.py b/utils/xyaml.py index 40661e8c..6ca71149 100755 --- a/utils/xyaml.py +++ b/utils/xyaml.py @@ -23,7 +23,7 @@ def load(f): data = data.decode('utf-8') # Strip out of ! data = re.sub("!<[^>]*>", "", data) - return yaml.load(io.StringIO(data)) + return yaml.safe_load(io.StringIO(data)) def tojson(f):