Skip to content

Upgrade pyyaml to 5.1#3698

Merged
ofek merged 1 commit into
masterfrom
jaime/pyyaml_bump
May 6, 2019
Merged

Upgrade pyyaml to 5.1#3698
ofek merged 1 commit into
masterfrom
jaime/pyyaml_bump

Conversation

@truthbk
Copy link
Copy Markdown
Member

@truthbk truthbk commented Apr 30, 2019

What does this PR do?

Bumps PyYaml to the latest 5.1.

Motivation

Enable new full_load() option for customers perhaps wanting to use that after load_all() was patched for security reasons.

Notes:

Not sure how you guys are dealing with versioning at the moment! Please enlighten me! :)

Related PRs: DataDog/omnibus-software#311, DataDog/dd-agent#3839

@truthbk truthbk requested a review from a team as a code owner April 30, 2019 09:38
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 30, 2019

Codecov Report

Merging #3698 into master will decrease coverage by 3.44%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #3698      +/-   ##
==========================================
- Coverage    86.2%   82.75%   -3.45%     
==========================================
  Files         729       93     -636     
  Lines       37497     5736   -31761     
  Branches     4494      667    -3827     
==========================================
- Hits        32325     4747   -27578     
+ Misses       3947      838    -3109     
+ Partials     1225      151    -1074

@truthbk truthbk force-pushed the jaime/pyyaml_bump branch from 8e75d37 to b0fdbff Compare April 30, 2019 10:03
@truthbk truthbk requested a review from a team as a code owner April 30, 2019 10:03
@ofek ofek changed the title [requirements] bumping pyyaml to 5.1 Upgrade pyyaml to 5.1 Apr 30, 2019
@truthbk
Copy link
Copy Markdown
Member Author

truthbk commented May 6, 2019

@ofek is this good to be merged? No need to manually bump versions or anything like that?

@truthbk
Copy link
Copy Markdown
Member Author

truthbk commented May 6, 2019

Note: Further context on why the monkey patch has been kept in place follows. The pyyaml authors go on to say the following about the 5.1 release yaml/pyyaml#257):

We still recommend that people choose SafeLoader for untrusted data, but
aribitrary code execution will no longer be possible using yaml.load() with
the default loader (FullLoader). FullLoader will instantiate objects of classes
that you have imported. Since object instantiation runs the class's constructor code, that may be exploitable.

Because the FullLoader still presents some exploitable vector we will wait for 6.0, when yaml.load() will raise an exception if no loader is specified in the calling code, to remove the monkey patch.

@ofek ofek merged commit def2cd8 into master May 6, 2019
@ofek ofek deleted the jaime/pyyaml_bump branch May 6, 2019 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants