We want to make sure we avoid unsafe yaml dumps, which can be used to dump arbitrary Python objects, because want to avoid unsafe yaml loads, which can execute arbitrary Python code and is a security risk.
It looks like we were sometimes dumping numpy objects (as can be seen in hexrd/hexrdgui#1625), and these cannot be loaded without performing an unsafe load.
This PR changes all regular yaml dumps to safe_dump to ensure this does not happen. It also adds a custom dumper that converts numpy types to native types while dumping. This is used when saving the instrument config currently (but we can use it in other places too, if needed).
We want to make sure we avoid unsafe yaml dumps, which can be used to dump arbitrary Python objects, because want to avoid unsafe yaml loads, which can execute arbitrary Python code and is a security risk.
It looks like we were sometimes dumping numpy objects (as can be seen in hexrd/hexrdgui#1625), and these cannot be loaded without performing an unsafe load.
This PR changes all regular yaml dumps to
safe_dumpto ensure this does not happen. It also adds a custom dumper that converts numpy types to native types while dumping. This is used when saving the instrument config currently (but we can use it in other places too, if needed).Fixes: hexrd/hexrdgui#1625