snyk incorrectly reporting 1 vulnerability

[JonZeolla]

Summary

snyk.io is currently reporting that the version of pyyaml used by easy_sast is vulnerable to an Arbitrary Code Execution vulnerability. easy_sast was never susceptible to this vulnerability, as it has always used safe_load which is considered safe. MITRE has assigned this vulnerability CVE-2020-1747.

Potential Impact

There is no impact to the easy_sast project due to the appropriate use of safe_load to load untrusted yaml files. pyyaml is used for configuration loading (pyyaml 5.3), and the testing (pyyaml 5.3) of configuration loading.

Next Steps

1. As a best practice, update the easy_sast requirements via make requirements when Prevents arbitrary code execution during python/object/new constructor yaml/pyyaml#386 is merged and included in a release.
2. Cut an easy_sast release with these updated requirements.
   • Based on the breaking changes introduced since the last release, this will be version 1.0.0 (see git log 'v0.2.0'...'0eefbb341facfdd5cfe73774faebdb311579d232' --oneline).