Fix# 1982: Fix security issue related to PyYAML dependency(#1983)

Cloud-CV · Jan 7, 2019 · b3abc4e · b3abc4e
1 parent 513ddf6
commit b3abc4e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/apps/challenges/views.py b/apps/challenges/views.py
@@ -563,7 +563,7 @@ def create_challenge_using_zip_file(request, challenge_host_team_pk):
 
     try:
         with open(join(BASE_LOCATION, unique_folder_name, yaml_file), "r") as stream:
-            yaml_file_data = yaml.load(stream)
+            yaml_file_data = yaml.safe_load(stream)
     except (yaml.YAMLError, ScannerError) as exc:
         message = 'Error in creating challenge. Please check the yaml configuration!'
         response_data = {

diff --git a/requirements/common.txt b/requirements/common.txt
@@ -16,6 +16,6 @@ pika==0.10.0
 pickleshare==0.7.4
 Pillow==3.4.2
 psycopg2==2.7.3.2
-PyYaml==3.12
+PyYaml==4.2b1
 proc==0.10.1
 rstr==2.2.5