From 98d3de9f08886950dec4006fdce1b1d467a724d2 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Sun, 9 Nov 2014 08:18:42 -0300 Subject: [PATCH] Use yaml.safe_load instead of load. yaml.load will execute arbitrary code. Also use context managers to ensure files are closed Change-Id: I704baa7916ee834c12821009d8e3029b1b8fa340 --- os_client_config/config.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/os_client_config/config.py b/os_client_config/config.py index 925c23f..c711919 100644 --- a/os_client_config/config.py +++ b/os_client_config/config.py @@ -87,12 +87,14 @@ class OpenStackConfig(object): def _load_config_file(self): for path in self._config_files: if os.path.exists(path): - return yaml.load(open(path, 'r')) + with open(path, 'r') as f: + return yaml.safe_load(f) def _load_vendor_file(self): for path in self._vendor_files: if os.path.exists(path): - return yaml.load(open(path, 'r')) + with open(path, 'r') as f: + return yaml.safe_load(f) def get_cache_max_age(self): return self._cache_max_age