Use yaml.safe_load instead of yaml.load to prevent avoid code execution

[ypid]

Ref: yaml/pyyaml#5

To keep us on the safe side before yaml/pyyaml#74 makes it’s way downstream.

Edit: CI build issues seem to be unrelated to my PR. I will sign the CLA later.

[untergeek]

Thank you for checking out against 5.x.

Aside from signing the CLA (would you please be so kind), there are a few tests which are still not working:

======================================================================
FAIL: test_do_something_with_int_value (test.integration.test_envvars.TestEnvVars)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/travis/build/elastic/curator/test/integration/test_envvars.py", line 75, in test_do_something_with_int_value
    os.environ.get(evar)
AssertionError: '${JMILLQK9}' != '1234'
======================================================================
FAIL: test_not_present (test.integration.test_envvars.TestEnvVars)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/travis/build/elastic/curator/test/integration/test_envvars.py", line 49, in test_not_present
    self.assertIsNone(cfg['client']['hosts'])
AssertionError: '${CFRR6PTB}' is not None
======================================================================
FAIL: test_not_present_with_default (test.integration.test_envvars.TestEnvVars)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/travis/build/elastic/curator/test/integration/test_envvars.py", line 61, in test_not_present_with_default
    default
AssertionError: '${ODS5TJRH:CRDYI2RJ}' != 'CRDYI2RJ'
======================================================================
FAIL: test_present (test.integration.test_envvars.TestEnvVars)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/travis/build/elastic/curator/test/integration/test_envvars.py", line 38, in test_present
    os.environ.get(evar)
AssertionError: '${LCE4Q46B}' != '1234'

Each of the 4 tests calls:

cfg = curator.get_yaml(self.args['configfile'])

So I imagine that there must be something related to the change.

[untergeek]

Could it be that yaml.safe_load doesn't respect environment variables?

[ypid]

@untergeek Thanks for you help. I have not checked this in detail, but the !single syntax looks like it depends on unsafe yaml.load. The risk of local code execution is not as bad as remote code execution which the use of yaml.load had in other projects. Feel free to use other ways of environment variable substitution.

[ypid]

This would require rework and I switched to ILM. Sorry for not continuing this!