Repository: Stranger6667/pyanyapi

Issue:
YAMLParser method is vulnerable 
from pyanyapi import YAMLParser
YAMLParser({'test': 'container > test'}).parse('!!python/object/apply:os.system ["calc.exe"]').test

Hi, there is a vulnerability in YAMLParser method in Interfaces.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.

Discussion:
codecov[bot]: # [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=h1) Report
> Merging [#42](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=desc) into [master](https://codecov.io/gh/Stranger6667/pyanyapi/commit/aebee636ad26f387850a6c8ab820ce4aac3f9adb?src=pr&el=desc) will **decrease** coverage by `1.85%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42/graphs/tree.svg?height=150&width=650&token=WWPz6pWARM&src=pr)](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master      #42      +/-   ##
==========================================
- Coverage   99.46%   97.61%   -1.86%     
==========================================
  Files           7        7              
  Lines         377      377              
  Branches       42       42              
==========================================
- Hits          375      368       -7     
- Misses          2        9       +7
```


| [Impacted Files](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pyanyapi/interfaces.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvaW50ZXJmYWNlcy5weQ==) | `100% <100%> (ø)` | :arrow_up: |
| [pyanyapi/\_compat.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvX2NvbXBhdC5weQ==) | `58.82% <0%> (-41.18%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=footer). Last update [aebee63...6fcd23b](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

codecov[bot]: # [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=h1) Report
> Merging [#42](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=desc) into [master](https://codecov.io/gh/Stranger6667/pyanyapi/commit/aebee636ad26f387850a6c8ab820ce4aac3f9adb?src=pr&el=desc) will **decrease** coverage by `1.85%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42/graphs/tree.svg?height=150&width=650&src=pr&token=WWPz6pWARM)](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master      #42      +/-   ##
==========================================
- Coverage   99.46%   97.61%   -1.86%     
==========================================
  Files           7        7              
  Lines         377      377              
  Branches       42       42              
==========================================
- Hits          375      368       -7     
- Misses          2        9       +7
```


| [Impacted Files](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pyanyapi/interfaces.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvaW50ZXJmYWNlcy5weQ==) | `100% <100%> (ø)` | :arrow_up: |
| [pyanyapi/\_compat.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvX2NvbXBhdC5weQ==) | `58.82% <0%> (-41.18%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=footer). Last update [aebee63...6fcd23b](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/.travis.yml b/.travis.yml
index 1975b26..b7b5b14 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,17 +1,30 @@
 language: python
 python:
   - 3.5
-env:
-  - TOX_ENV=py26
-  - TOX_ENV=py27
-  - TOX_ENV=py32
-  - TOX_ENV=py33
-  - TOX_ENV=py34
-  - TOX_ENV=py35
-  - TOX_ENV=pypy
-  - TOX_ENV=pypy3
-  - JYTHON=true
+matrix:
+  fast_finish: true
+  include:
+    - python: 3.5
+      env: TOX_ENV=py35
+    - python: 3.4
+      env: TOX_ENV=py34
+    - python: 3.3
+      env: TOX_ENV=py33
+    - python: 3.2
+      env: TOX_ENV=py32
+    - python: 2.7
+      env: TOX_ENV=py27
+    - python: 2.6
+      env: TOX_ENV=py26
+    - python: pypy
+      env: TOX_ENV=pypy
+    - python: pypy3
+      env: TOX_ENV=pypy3
+    - python: 3.5
+      env: $JYTHON=true
 install:
+  - if [ $TOX_ENV = "py32" ]; then travis_retry pip install "virtualenv<14.0.0" "tox<1.8.0"; fi
+  - if [ $TOX_ENV = "pypy3" ]; then travis_retry pip install "virtualenv<14.0.0" "tox<1.8.0"; fi
   - if [ -z "$JYTHON" ]; then pip install codecov; fi
   - if [ "$TOX_ENV" ]; then travis_retry pip install "virtualenv<14.0.0" tox; fi
 before_install:
@@ -22,4 +35,4 @@ script:
   - if [ "$JYTHON" ]; then travis_retry jython setup.py test; fi
   - if [ "$TOX_ENV" ]; then tox -e $TOX_ENV; fi
 after_success:
-  - codecov
\ No newline at end of file
+  - codecov
diff --git a/pyanyapi/interfaces.py b/pyanyapi/interfaces.py
index 698c637..c0914b2 100644
--- a/pyanyapi/interfaces.py
+++ b/pyanyapi/interfaces.py
@@ -274,7 +274,7 @@ class YAMLInterface(DictInterface):
 
     def perform_parsing(self):
         try:
-            return yaml.load(self.content)
+            return yaml.safe_load(self.content)
         except yaml.error.YAMLError:
             raise ResponseParseError(self._error_message, self.content)
 


Test patch:
diff --git a/tests/test_parsers.py b/tests/test_parsers.py
index 38223e2..4958b21 100644
--- a/tests/test_parsers.py
+++ b/tests/test_parsers.py
@@ -63,6 +63,15 @@ def test_yaml_parser_error():
         parsed.test
 
 
+def test_yaml_parser_vulnerability():
+    """
+    In case of usage of yaml.load `test` value will be equal to 0.
+    """
+    parsed = YAMLParser({'test': 'container > test'}).parse('!!python/object/apply:os.system ["exit 0"]')
+    with pytest.raises(ResponseParseError):
+        parsed.test
+
+
 @lxml_is_supported
 @pytest.mark.parametrize(
     'settings', (