Repository: dynaconf/dynaconf

Issue:
YAML.load without a loader is deprecated for security purposes
We've started seeing the following warning:
```
lib/python3.6/site-packages/dynaconf/loaders/base.py:95: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.
```

See here: https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation


Discussion:
@dmsimard thanks for reporting.

we have some options now

The current Loader choices are:
```
    BaseLoader

    Only loads the most basic YAML

    SafeLoader

    Loads a subset of the YAML language, safely. This is recommended for loading untrusted input.

    FullLoader

    Loads the full YAML language. Avoids arbitrary code execution. This is currently (PyYAML 5.1) the default loader called by yaml.load(input) (after issuing the warning).

    UnsafeLoader (also called Loader for backwards compatability)

    The original Loader code that could be easily exploitable by untrusted data input.
```
You may also use one of the shortcut "sugar" methods:
```
    yaml.safe_load
    yaml.full_load
    yaml.unsafe_load
```

I am inclined to keep using the `unsafe_load` because I know some users which are using `!!python` and `!!bash` tokens.

Another options is to default to `safe_load` and have a config var `YAML_LOADER_FOR_DYNACONF=safe_load|full_load|unsafe_load`
@rochacbruno defaulting to unsafe_load is more or less the current approach that pyyaml took for similar reasons.
As a user of dynaconf, I'd expect to be able to use safe_load if I don't need unsafe_load -- a configuration option is fine.

The only thing I would make sure is that if unsafe_load is used, the deprecation/security warning is still printed. Users need to be aware that safe_load is preferred.

Resolving patch:
diff --git a/dynaconf/loaders/yaml_loader.py b/dynaconf/loaders/yaml_loader.py
--- a/dynaconf/loaders/yaml_loader.py
+++ b/dynaconf/loaders/yaml_loader.py
@@ -1,10 +1,13 @@
 # coding: utf-8
 import io
+import os
 from pathlib import Path
+from warnings import warn
 from dynaconf import default_settings
 from dynaconf.loaders.base import BaseLoader
 from dynaconf.constants import YAML_EXTENSIONS
 from dynaconf.utils import object_merge
+
 try:
     import yaml
 except ImportError as e:  # pragma: no cover
@@ -26,13 +29,25 @@ def load(obj, env=None, silent=True, key=None, filename=None):
         BaseLoader.warn_not_installed(obj, 'yaml')
         return
 
+    # Resolve the loaders
+    # https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
+    # Possible values are `safe_load, full_load, unsafe_load, load`
+    yaml_loader_name = os.environ.get('YAML_LOADER_FOR_DYNACONF', 'full_load')
+    yaml_reader = getattr(yaml, yaml_loader_name, yaml.load)
+    if yaml_reader.__name__ == 'unsafe_load':  # pragma: no cover
+        warn(
+            "yaml.unsafe_load is deprecated."
+            " Please read https://msg.pyyaml.org/load for full details."
+            " Try to use full_load or safe_load."
+        )
+
     loader = BaseLoader(
         obj=obj,
         env=env,
         identifier='yaml',
         extensions=YAML_EXTENSIONS,
-        file_reader=yaml.load,
-        string_reader=yaml.load
+        file_reader=yaml_reader,
+        string_reader=yaml_reader
     )
     loader.load(filename=filename, key=key, silent=silent)
 


Test patch: