andresbott / ansible-autodoc

ansible-autodoc generates documentation from annotated Ansible Playbooks and Roles.
GNU Lesser General Public License v3.0
46 stars 26 forks source link

Update yaml.load to yaml.safe_load #10

Closed ghost closed 1 year ago

ghost commented 2 years ago

While running ansible-autodoc -y we were getting:

[ERROR]:  
 Traceback (most recent call last):
  File "/usr/local/bin/ansible-autodoc", line 6, in <module>
    doc = AnsibleAutodoc()
  File "/usr/local/lib/python3.8/site-packages/ansibleautodoc/AutodocCli.py", line 21, in __init__
    doc_parser = Parser()
  File "/usr/local/lib/python3.8/site-packages/ansibleautodoc/DocumentationParser.py", line 34, in __init__
    self._populate_doc_data()
  File "/usr/local/lib/python3.8/site-packages/ansibleautodoc/DocumentationParser.py", line 42, in _populate_doc_data
    self._annotation_objs[annotaion] = Annotation(name=annotaion, files_registry=self._files_registry)
  File "/usr/local/lib/python3.8/site-packages/ansibleautodoc/Annotation.py", line 90, in __init__
    self._find_tags()
  File "/usr/local/lib/python3.8/site-packages/ansibleautodoc/Annotation.py", line 275, in _find_tags
    data = yaml.load(yaml_file)
TypeError: load() missing 1 required positional argument: 'Loader'

We also found this:

Now, the load() function requires parameter loader=Loader. If your YAML file contains just simple YAML (str, int, lists), try to use yaml.safe_load() instead of yaml.load(). And If you need FullLoader, you can use yaml.full_load(). Starting from pyyaml>=5.4, it doesn't have any discovered critical vulnerabilities, pyyaml status. source: https://stackoverflow.com/a/1774043/13755823 yaml.safe_load() should always be preferred unless you explicitly need the arbitrary object serialization/deserialization provided in order to avoid introducing the possibility for arbitrary code execution. More about yaml.load(input) here.


We replaced the yaml.load with the yaml.safe_load directly in the /usr/local/lib/python3.8/site-packages/ansibleautodoc/Annotation.py and it worked as it should.