Skip to content

GitLab

  • Menu
Projects Groups Snippets
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in / Register
  • lava lava
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 90
    • Issues 90
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 48
    • Merge requests 48
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI/CD
    • Repository
    • Value stream
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • lava
  • lavalava
  • Merge requests
  • !1925

Merged
Created Jan 10, 2023 by Igor Ponomarev@igo95862Contributor

Use safe yaml everywhere

  • Overview 5
  • Commits 1
  • Changes 70

On Debian 11 the default loader was already equivalent to safe loader because Debian patched out the extra python classes that default loader could load to fix CVE-2020-14343.

It looks like originally the default un-safe loader was used to load OrderedDict that preserves the order of dictionaries keys. However, since Python 3.6 the dictionaries are ordered by default.

This means that the safe loader could be used everywhere. This would prevent any future vulnerabilities that could arise from loading custom python classes.

Assignee
Assign to
Reviewer
Request review from
Time tracking
Source branch: yaml-safe-everywhere