Fix issue with yaml.load in docker collector 45/89345/2
authorTomáš Levora <t.levora@partner.samsung.com>
Wed, 5 Jun 2019 10:53:05 +0000 (12:53 +0200)
committerTomáš Levora <t.levora@partner.samsung.com>
Wed, 5 Jun 2019 11:31:42 +0000 (11:31 +0000)
docker-images-collector.sh script uses yaml.load python function in
deprecated way and it is a potential security risk

https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation

Issue-ID: OOM-1897

Change-Id: Ie30e60b4ede2c87a02b7bbe76e0695f91dc207c6
Signed-off-by: Tomáš Levora <t.levora@partner.samsung.com>
build/creating_data/docker-images-collector.sh

index 9206b0b..6761c32 100755 (executable)
@@ -47,7 +47,7 @@ import yaml
 import sys
 
 with open("${1}", 'r') as f:
-    values = yaml.load(f)
+    values = yaml.load(f, Loader=yaml.SafeLoader)
 
     enabled = filter(lambda x: values[x].get('enabled', False) == True, values)
     print(' '.join(enabled))