Skip to content

Address security bug in yaml loading (backport #313)#484

Merged
aprotyas merged 1 commit intofoxyfrom
mergify/bp/foxy/pr-313
Dec 8, 2021
Merged

Address security bug in yaml loading (backport #313)#484
aprotyas merged 1 commit intofoxyfrom
mergify/bp/foxy/pr-313

Conversation

@mergify
Copy link
Contributor

@mergify mergify bot commented Dec 7, 2021

This is an automatic backport of pull request #313 done by Mergify.


Mergify commands and options

More conditions and actions can be found in the documentation.

You can also trigger Mergify actions by commenting on this pull request:

  • @Mergifyio refresh will re-evaluate the rules
  • @Mergifyio rebase will rebase this PR on its base branch
  • @Mergifyio update will merge the base branch into this PR
  • @Mergifyio backport <destination> will backport this PR on <destination> branch

Additionally, on Mergify dashboard you can:

  • look at your merge queues
  • generate the Mergify configuration with the config editor.

Finally, you can contact us on https://mergify.com

Curate bug similar to ros/actionlib#171.

Connected with aliasrobotics/RVD#2401.

(cherry picked from commit e893ca7)
@aprotyas
Copy link
Member

aprotyas commented Dec 8, 2021

Backporting #313 because invoking view_frames.py from the foxy branch source generates this warning:

/root/ws/install/tf2_tools/lib/tf2_tools/view_frames.py:75: YAMLLoadWarning: calling yaml.load() without
Loader=... is deprecated, as the default Loader is unsafe.
Please read https://msg.pyyaml.org/load for full details.
  data = yaml.load(result.frame_yaml)

@aprotyas
Copy link
Member

aprotyas commented Dec 8, 2021

CI:
Repos file: https://gist.githubusercontent.com/aprotyas/b2f8d5af5ecb15e9b05c25ad4e91ea91/raw/fe0600f807c5a5f3148010bf6c48242a91bce05c/ros2.repos
Build args: --packages-up-to tf2_tools
Test args: --packages-select tf2_tools
Job: https://ci.ros2.org/job/ci_launcher/9466/

  • Linux Build Status
  • Linux-aarch64 Build Status
  • macOS Build Status
  • Windows Build Status

@aprotyas
Copy link
Member

aprotyas commented Dec 8, 2021

Green CI + approval, so I'll merge this PR.

@aprotyas aprotyas merged commit b527440 into foxy Dec 8, 2021
@delete-merged-branch delete-merged-branch bot deleted the mergify/bp/foxy/pr-313 branch December 8, 2021 20:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants