Change yaml.load to yaml.safe_load
Change yaml.load to yaml.safe_load

yaml.load allows essentially arbitrary code execution, and its advanced features are not exposed, so it makes since to modify this this safe_load for security.

 This vulnerability was reported by Daniel Shahaf. Email appended.

 ---

Date: Tue, 12 May 2015 01:38:06 +0000
From: Daniel Shahaf <..>
To: Andy Chase <..>
Subject: [reparse] yaml.safe_load
Message-ID: <20150512013806.GE2165@tarsus.local2>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)

Good morning Andy,

Your RE|PARSE library uses PyYaml's yaml.load, which may execute
arbitrary code.  Have you considered using yaml.safe_load instead?
(See [1].)

I am not aware of a concrete vulnerability, but it follows from the
principle of least privilege that yaml.safe_load should be used unless
there is a specific reason to use yaml.load, so I would suggest the
attached patch.

As to compatibility with existing downstream code that relies on the
unsafe load being used, I see two options: either have the downstream
code mark the objects safe (as documented in [1]) or add
an optional keyword argument to RE|PARSE's parsers.parse() to allow
callers to opt-in to using the unsafe yaml.load function.

Would this make sense?

Cheers,

Daniel

P.S. I don't actually use RE|PARSE, but I ran into this issue while
comparing some Python parser projects.

[1] http://pyyaml.org/wiki/PyYAMLDocumentation#LoadingYAML
[2] https://bugs.launchpad.net/ubuntu/+source/pyyaml/+bug/1385077

diff --git a/reparse/parsers.py b/reparse/parsers.py
index d69a86a..40cee8a 100644
--- a/reparse/parsers.py
+++ b/reparse/parsers.py
@@ -75,7 +75,7 @@ def parser(parser_type=basic_parser, functions=None, patterns=None, expressions=
     def _load_yaml(file_path):
         import yaml
         with open(file_path) as f:
-            return yaml.load(f)
+            return yaml.safe_load(f)

     assert expressions or expressions_yaml_path, "RE|PARSE can't build a parser without expressions"
     assert patterns or patterns_yaml_path, "RE|PARSE can't build a parser without patterns"

andychase/reparse,photonovus/reparse