Repository: chaostoolkit/chaostoolkit-lib

Issue:
Update yaml loader to use the safe loader 
Currently we don't load yaml using the safe mechanism of the yaml package. This should be the case as we read from unsafe places.

Discussion:

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 317f3d5..2208464 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@
 
 [Unreleased]: https://github.com/chaostoolkit/chaostoolkit-lib/compare/1.1.1...HEAD
 
+### Changed
+
+- Use a YAML safe loader for settings [#92][92]
+
+[92]: https://github.com/chaostoolkit/chaostoolkit-lib/issues/92
+
 ## [1.1.1][] - 2019-03-22
 
 [1.1.1]: https://github.com/chaostoolkit/chaostoolkit-lib/compare/1.1.0...1.1.1
diff --git a/chaoslib/settings.py b/chaoslib/settings.py
index fc5047f..29056bb 100644
--- a/chaoslib/settings.py
+++ b/chaoslib/settings.py
@@ -23,7 +23,10 @@ def load_settings(settings_path: str = CHAOSTOOLKIT_CONFIG_PATH) -> Settings:
         return
 
     with open(settings_path) as f:
-        return yaml.load(f.read())
+        try:
+            return yaml.safe_load(f.read())
+        except yaml.YAMLError as ye:
+            logger.error("Failed parsing YAML settings: {}".format(str(ye)))
 
 
 def save_settings(settings: Settings,


Test patch:
diff --git a/tests/fixtures/unsafe-settings.yaml b/tests/fixtures/unsafe-settings.yaml
new file mode 100644
index 0000000..8c04763
--- /dev/null
+++ b/tests/fixtures/unsafe-settings.yaml
@@ -0,0 +1,4 @@
+
+!!python/object/apply:os.system
+args: ['Hello shell!']
+
diff --git a/tests/test_settings.py b/tests/test_settings.py
index 9ce34a6..282bfca 100644
--- a/tests/test_settings.py
+++ b/tests/test_settings.py
@@ -26,3 +26,9 @@ def test_save_settings():
     saved_settings = load_settings(new_settings_location)
     assert "notifications" in saved_settings
     os.remove(new_settings_location)
+
+
+def test_load_unsafe_settings():
+    settings = load_settings(
+        os.path.join(settings_dir, "unsafe-settings.yaml"))
+    assert settings is None