From 836a1d3911ce8b71f99171ea039506d1ac810127 Mon Sep 17 00:00:00 2001
From: Matt Jia <mjia@redhat.com>
Date: Jul 27 2017 01:33:55 +0000
Subject: use yaml.safe_load_all for security reasons


---

diff --git a/greenwave/app_factory.py b/greenwave/app_factory.py
index 778ed7f..1e7986c 100644
--- a/greenwave/app_factory.py
+++ b/greenwave/app_factory.py
@@ -39,7 +39,7 @@ def create_app(config_obj=None):
     policy_pathnames = glob.glob(os.path.join(app.config['POLICIES_DIR'], '*.yaml'))
     app.config['policies'] = []
     for policy_pathname in policy_pathnames:
-        app.config['policies'].extend(yaml.load_all(open(policy_pathname, 'r')))
+        app.config['policies'].extend(yaml.safe_load_all(open(policy_pathname, 'r')))
     # register error handlers
     app.register_error_handler(ConnectionError, lambda e: (str(e), 503))
     app.register_error_handler(Timeout, lambda e: (str(e), 503))
diff --git a/greenwave/policies.py b/greenwave/policies.py
index 129ee12..cc79bcc 100644
--- a/greenwave/policies.py
+++ b/greenwave/policies.py
@@ -134,6 +134,7 @@ class PassingTestCaseRule(Rule):
     a non-passing result with a waiver.
     """
     yaml_tag = u'!PassingTestCaseRule'
+    yaml_loader = yaml.SafeLoader
 
     def __init__(self, test_case_name):
         self.test_case_name = test_case_name
@@ -157,6 +158,7 @@ class PassingTestCaseRule(Rule):
 
 class Policy(yaml.YAMLObject):
     yaml_tag = u'!Policy'
+    yaml_loader = yaml.SafeLoader
 
     def __init__(self, id, product_versions, decision_context, rules):
         self.id = id