False positive when yaml.load is used with "Loader=yaml.SafeLoader"

[Cyril Roelandt]

Consider this piece of code:

yaml.load("dt: !!python/object/apply:time.gmtime []")

Bandit will report an issue (use of unsafe yaml load). A possible fix is:

yaml.safe_load("dt: !!python/object/apply:time.gmtime []")

Bandit will not complain when reading the above line. But it will emit a warning for the following line:

dt = yaml.load("dt: !!python/object/apply:time.gmtime []", Loader=yaml.SafeLoader)

Even though it is exactly as safe as using "yaml.safe_load".

Bandit should not emit a warning when "yaml.load" is used with "Loader=yaml.SafeLoader", though it might be ok in complex cases such as "yaml.load(..., Loader=<variable>)".

[Travis McPeak (travis-mcpeak)]

Good point

[Tim Kelsey (tim-kelsey)]

good catch Cyril

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/267747

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/267747
Committed: https://git.openstack.org/cgit/openstack/bandit/commit/?id=b09c0e38c685785fc48f9d7c6146edf1447683df
Submitter: Jenkins
Branch: master

commit b09c0e38c685785fc48f9d7c6146edf1447683df
Author: mattvaldes <email address hidden>
Date: Thu Jan 14 12:02:59 2016 -0600

    Split yaml blacklist check into its own file

    Allow SafeLoader to be passed to the Loader parameter
    Closes-bug: 1508490

    Change-Id: I7459577e175b5f2a623316e22c63b2d42ba1db25