NotificationsYou must be signed in to change notification settings
Fork538
Star2.7k

Commita001f27

committed

Fix forCVE-2020-14343

Per suggestion#420 (comment)move a few constructors from full_load to unsafe_load.

1 parentfe15062 commita001f27Copy full SHA for a001f27

File tree

4 files changed

+26

-26

lines changed

lib3/yaml
- constructor.py
lib/yaml
- constructor.py
tests
- lib3
  - test_recursive.py
- lib
  - test_recursive.py

4 files changed

+26

-26

lines changed

`‎lib/yaml/constructor.py`

Lines changed: 12 additions & 12 deletions

Original file line number	Diff line number	Diff line change
`@@ -722,18 +722,6 @@ def construct_python_object_new(self, suffix, node):`
`722`	`722`	`u'tag:yaml.org,2002:python/name:',`
`723`	`723`	`FullConstructor.construct_python_name)`
`724`	`724`
`725`		`-FullConstructor.add_multi_constructor(`
`726`		`-u'tag:yaml.org,2002:python/module:',`
`727`		`-FullConstructor.construct_python_module)`
`728`		`-`
`729`		`-FullConstructor.add_multi_constructor(`
`730`		`-u'tag:yaml.org,2002:python/object:',`
`731`		`-FullConstructor.construct_python_object)`
`732`		`-`
`733`		`-FullConstructor.add_multi_constructor(`
`734`		`-u'tag:yaml.org,2002:python/object/new:',`
`735`		`-FullConstructor.construct_python_object_new)`
`736`		`-`
`737`	`725`	`classUnsafeConstructor(FullConstructor):`
`738`	`726`
`739`	`727`	`deffind_python_module(self,name,mark):`
`@@ -750,6 +738,18 @@ def set_python_instance_state(self, instance, state):`
`750`	`738`	`returnsuper(UnsafeConstructor,self).set_python_instance_state(`
`751`	`739`	`instance,state,unsafe=True)`
`752`	`740`
	`741`	`+UnsafeConstructor.add_multi_constructor(`
	`742`	`+u'tag:yaml.org,2002:python/module:',`
	`743`	`+UnsafeConstructor.construct_python_module)`
	`744`	`+`
	`745`	`+UnsafeConstructor.add_multi_constructor(`
	`746`	`+u'tag:yaml.org,2002:python/object:',`
	`747`	`+UnsafeConstructor.construct_python_object)`
	`748`	`+`
	`749`	`+UnsafeConstructor.add_multi_constructor(`
	`750`	`+u'tag:yaml.org,2002:python/object/new:',`
	`751`	`+UnsafeConstructor.construct_python_object_new)`
	`752`	`+`
`753`	`753`	`UnsafeConstructor.add_multi_constructor(`
`754`	`754`	`u'tag:yaml.org,2002:python/object/apply:',`
`755`	`755`	`UnsafeConstructor.construct_python_object_apply)`

`‎lib3/yaml/constructor.py`

Lines changed: 12 additions & 12 deletions

Original file line number	Diff line number	Diff line change
`@@ -710,18 +710,6 @@ def construct_python_object_new(self, suffix, node):`
`710`	`710`	`'tag:yaml.org,2002:python/name:',`
`711`	`711`	`FullConstructor.construct_python_name)`
`712`	`712`
`713`		`-FullConstructor.add_multi_constructor(`
`714`		`-'tag:yaml.org,2002:python/module:',`
`715`		`-FullConstructor.construct_python_module)`
`716`		`-`
`717`		`-FullConstructor.add_multi_constructor(`
`718`		`-'tag:yaml.org,2002:python/object:',`
`719`		`-FullConstructor.construct_python_object)`
`720`		`-`
`721`		`-FullConstructor.add_multi_constructor(`
`722`		`-'tag:yaml.org,2002:python/object/new:',`
`723`		`-FullConstructor.construct_python_object_new)`
`724`		`-`
`725`	`713`	`classUnsafeConstructor(FullConstructor):`
`726`	`714`
`727`	`715`	`deffind_python_module(self,name,mark):`
`@@ -738,6 +726,18 @@ def set_python_instance_state(self, instance, state):`
`738`	`726`	`returnsuper(UnsafeConstructor,self).set_python_instance_state(`
`739`	`727`	`instance,state,unsafe=True)`
`740`	`728`
	`729`	`+UnsafeConstructor.add_multi_constructor(`
	`730`	`+'tag:yaml.org,2002:python/module:',`
	`731`	`+UnsafeConstructor.construct_python_module)`
	`732`	`+`
	`733`	`+UnsafeConstructor.add_multi_constructor(`
	`734`	`+'tag:yaml.org,2002:python/object:',`
	`735`	`+UnsafeConstructor.construct_python_object)`
	`736`	`+`
	`737`	`+UnsafeConstructor.add_multi_constructor(`
	`738`	`+'tag:yaml.org,2002:python/object/new:',`
	`739`	`+UnsafeConstructor.construct_python_object_new)`
	`740`	`+`
`741`	`741`	`UnsafeConstructor.add_multi_constructor(`
`742`	`742`	`'tag:yaml.org,2002:python/object/apply:',`
`743`	`743`	`UnsafeConstructor.construct_python_object_apply)`

`‎tests/lib/test_recursive.py`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ def test_recursive(recursive_filename, verbose=False):`
`30`	`30`	`output2=None`
`31`	`31`	`try:`
`32`	`32`	`output1=yaml.dump(value1)`
`33`		`-value2=yaml.load(output1,yaml.FullLoader)`
	`33`	`+value2=yaml.load(output1,yaml.UnsafeLoader)`
`34`	`34`	`output2=yaml.dump(value2)`
`35`	`35`	`assertoutput1==output2, (output1,output2)`
`36`	`36`	`finally:`

`‎tests/lib3/test_recursive.py`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ def test_recursive(recursive_filename, verbose=False):`
`31`	`31`	`output2=None`
`32`	`32`	`try:`
`33`	`33`	`output1=yaml.dump(value1)`
`34`		`-value2=yaml.full_load(output1)`
	`34`	`+value2=yaml.unsafe_load(output1)`
`35`	`35`	`output2=yaml.dump(value2)`
`36`	`36`	`assertoutput1==output2, (output1,output2)`
`37`	`37`	`finally:`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commita001f27

File tree

4 files changed

4 files changed

`‎lib/yaml/constructor.py`

`‎lib3/yaml/constructor.py`

`‎tests/lib/test_recursive.py`

`‎tests/lib3/test_recursive.py`

0 commit comments