From 9bec404efa83da4bc4d09cbd6008a8ddbe73b1d9 Mon Sep 17 00:00:00 2001 From: Ruslan Kuprieiev Date: Thu, 4 Jan 2018 09:38:36 +0200 Subject: [PATCH] yaml: use safe_load and safe_dump We don't need to support python objects in our dvc files, so we should only use safe_ functionality to avoid possible bugs when entries in dvc files are represented as py objects. Fixes #372 --- dvc/stage.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dvc/stage.py b/dvc/stage.py index ec95cb1fd..a17ddc8f3 100644 --- a/dvc/stage.py +++ b/dvc/stage.py @@ -247,7 +247,7 @@ class Stage(object): @staticmethod def load(project, fname): with open(fname, 'r') as fd: - return Stage.loadd(project, yaml.load(fd), fname) + return Stage.loadd(project, yaml.safe_load(fd), fname) def dumpd(self): deps = [x.dumpd(self.cwd) for x in self.deps] @@ -265,7 +265,7 @@ class Stage(object): fname = self.path with open(fname, 'w') as fd: - yaml.dump(self.dumpd(), fd, default_flow_style=False) + yaml.safe_dump(self.dumpd(), fd, default_flow_style=False) def save(self): for dep in self.deps: