search

awslabs / aws-cfn-template-flip

Tool for converting AWS CloudFormation templates between JSON and YAML formats.
Apache License 2.0
994 stars 142 forks source link

[Security] Use yaml.SafeLoader instead of yaml.Loader/yaml.FullLoader (same as yaml.UnsafeLoader) #101

Closed kamadorueda closed 3 years ago

kamadorueda commented 4 years ago

here: https://github.com/awslabs/aws-cfn-template-flip/blob/master/cfn_tools/yaml_loader.py#L20

image

as explained here:

https://pyyaml.org/wiki/PyYAMLDocumentation#LoadingYAML

image

an in the source-code comment:

image

is insecure, we should use SafeLoader instead

koiker commented 4 years ago

I have updated the Loader to FullLoader in the fix/max-col-width. Are you using Python 2.7 or 3.x? The new version will deprecate python 2.7 and will only work with python 3.x

kamadorueda commented 4 years ago

That's awesome!

kamadorueda commented 4 years ago

Seems like FullLoader is also vulnerable: https://github.com/yaml/pyyaml/issues/420

I've updated the issue

koiker commented 3 years ago

Fixed in #102