Fix pyyaml security issues (#57)

* Fix security issues * Fix security issues - bump version
MicroarrayTecnologia · Mar 31, 2019 · 9c2d91e · 9c2d91e
1 parent dd9f6fb
commit 9c2d91e
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 6 deletions.
diff --git a/.bumpversion.cfg b/.bumpversion.cfg
@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.1.9
+current_version = 0.1.10
 
 [bumpversion:file:setup.py]
 
diff --git a/setup.py b/setup.py
@@ -28,7 +28,7 @@ def get_requirements(req_file):
 
 setup(
     name='spec-synthase',
-    version='0.1.9',
+    version='0.1.10',
     license='MPL2',
     description='spec-synthase is a tool to help deal with big swagger files, by building the swagger specification files from little spec files. ',
     long_description=read('README.rst'),

diff --git a/specsynthase/specbuilder.py b/specsynthase/specbuilder.py
@@ -10,7 +10,7 @@ def __init__(self, *args, **kwargs):
 
     def _load_spec(self, file_name):
         with open(file_name, 'r') as spec_file:
-            return yaml.load(spec_file)
+            return yaml.load(spec_file, Loader=yaml.FullLoader)
 
     def _merge_part(self, key, part_dict):
         if part_dict:

diff --git a/tests/test_specsynthase.py b/tests/test_specsynthase.py
@@ -19,7 +19,9 @@ def _check_dicts(l, r):
 
 def test_build_fluent():
     base_dir = _get_base_dir()
-    full = yaml.load(open(path.join(base_dir, "full.yml")).read())
+    full = yaml.load(
+        open(path.join(base_dir, "full.yml")).read(),
+        Loader=yaml.FullLoader)
     spec = SpecBuilder().add_spec(path.join(base_dir, "security.yml"))\
                         .add_spec(path.join(base_dir, "base.yml"))\
                         .add_spec(path.join(base_dir, "definitions.yml"))\
@@ -39,15 +41,17 @@ def test_build_existing_key():
 def test_dump():
     base_dir = _get_base_dir()
     parts = ["base.yml", "definitions.yml", "paths.yml", "security.yml"]
-    full = yaml.load(open(path.join(base_dir, "full.yml")).read())
+    full = yaml.load(
+        open(path.join(base_dir, "full.yml")).read(),
+        Loader=yaml.FullLoader)
 
     spec = SpecBuilder()
     for p in parts:
         spec.add_spec(path.join(base_dir, p))
 
     # Dumping and reloading the yaml is slow, but we can't compare dumped
     # strings because of potential key ordering differences.
-    assert full == yaml.load(spec.dump())
+    assert full == yaml.load(spec.dump(), Loader=yaml.FullLoader)
 
 
 def test_validation_fail():