commit 513cb2d19abfbe5b3aea879bf1a0561ea211e7d4
author David Garcia <david.garcia@canonical.com> Tue May 31 11:01:09 2022 +0200
committer David Garcia <david.garcia@canonical.com> Tue May 31 11:01:09 2022 +0200
tree f8254edf52215786aa3b4b1cbac1e9ff19a41a6b
parent 5832638ae4b3f768c6b5442a3ecbdd0ac3d5c822

Fix security bug: Deserialization of Untrusted Data

Change-Id: I6228e249bdb0acf6f18924910fbb7105fc519eb4
Signed-off-by: David Garcia <david.garcia@canonical.com>

n2vc/k8s_helm_base_conn.py

diff --git a/n2vc/k8s_helm_base_conn.py b/n2vc/k8s_helm_base_conn.py
index 952630a..d446b9b 100644
--- a/n2vc/k8s_helm_base_conn.py
+++ b/n2vc/k8s_helm_base_conn.py
@@ -1888,7 +1888,7 @@
             for key in params:
                 value = params.get(key)
                 if "!!yaml" in str(value):
-                    value = yaml.load(value[7:])
+                    value = yaml.safe_load(value[7:])
                 params2[key] = value
 
             values_file = get_random_number() + ".yaml"