Only permit yaml.safe_loading of data

Event trusted data, belt + suspenders method.

lib/galaxy/containers/__init__.py

@@ -306,7 +306,7 @@ def parse_containers_config(containers_config_file):
     conf = DEFAULT_CONF.copy()
     try:
         with open(containers_config_file) as fh:
-            c = yaml.load(fh)
+            c = yaml.safe_load(fh)
             conf.update(c.get('containers', {}))
     except (OSError, IOError) as exc:
         if exc.errno == errno.ENOENT:

lib/galaxy/datatypes/registry.py

@@ -359,7 +359,7 @@ class Registry(object):
             build_sites_config_file = getattr(self.config, "build_sites_config_file", None)
             if build_sites_config_file and os.path.exists(build_sites_config_file):
                 with open(build_sites_config_file, "r") as f:
-                    build_sites_config = yaml.load(f)
+                    build_sites_config = yaml.safe_load(f)
                 if not isinstance(build_sites_config, list):
                     self.log.exception("Build sites configuration YAML file does not declare list of sites.")
                     return

lib/galaxy/jobs/runners/pulsar.py

@@ -217,7 +217,7 @@ class PulsarJobRunner(AsynchronousJobRunner):
         else:
             log.info("Loading Pulsar app configuration from %s" % pulsar_conf_path)
             with open(pulsar_conf_path, "r") as f:
-                conf.update(yaml.load(f) or {})
+                conf.update(yaml.safe_load(f) or {})
         if "job_metrics_config_file" not in conf:
             conf["job_metrics"] = self.app.job_metrics
         if "staging_directory" not in conf:

lib/galaxy/tools/deps/conda_compat.py

@@ -61,7 +61,7 @@ def _render_jinja2(recipe_dir):
 
 @_Memoized
 def yamlize(data):
-    res = yaml.load(data)
+    res = yaml.safe_load(data)
     # ensure the result is a dict
     if res is None:
         res = {}

lib/galaxy/tools/deps/resolvers/__init__.py

@@ -97,7 +97,7 @@ class MappableDependencyResolver:
     @staticmethod
     def _mapping_file_to_list(mapping_file):
         with open(mapping_file, "r") as f:
-            raw_mapping = yaml.load(f) or []
+            raw_mapping = yaml.safe_load(f) or []
         return map(RequirementMapping.from_dict, raw_mapping)
 
     def _expand_mappings(self, requirement):

lib/galaxy/tools/locations/dockstore.py

@@ -57,7 +57,7 @@ class _Ga4ghToolClient(object):
         if as_string:
             return descriptor_str
         else:
-            return yaml.load(descriptor_str)
+            return yaml.safe_load(descriptor_str)
 
     @property
     def _requests(self):

lib/galaxy/tools/parser/factory.py

@@ -62,7 +62,7 @@ def ordered_load(stream):
         yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG,
         construct_mapping)
 
-    return yaml.load(stream, OrderedLoader)
+    return yaml.safe_load(stream, OrderedLoader)
 
 
 def get_input_source(content):

lib/galaxy/tools/toolbox/parser.py

@@ -59,7 +59,7 @@ class YamlToolConfSource(ToolConfSource):
 
     def __init__(self, config_filename):
         with open(config_filename, "r") as f:
-            as_dict = yaml.load(f)
+            as_dict = yaml.safe_load(f)
         self.as_dict = as_dict
 
     def parse_tool_path(self):

lib/galaxy/tours/__init__.py

@@ -68,7 +68,7 @@ class ToursRegistry(object):
         tour_id = os.path.splitext(filename)[0]
         try:
             with open(tour_path) as handle:
-                conf = yaml.load(handle)
+                conf = yaml.safe_load(handle)
                 tour = tour_loader(conf)
                 self.tours[tour_id] = tour_loader(conf)
                 log.info("Loaded tour '%s'" % tour_id)

lib/galaxy/util/plugin_config.py

@@ -83,4 +83,4 @@ def __read_yaml(path):
         raise ImportError("Attempting to read YAML configuration file - but PyYAML dependency unavailable.")
 
     with open(path, "rb") as f:
-        return yaml.load(f)
+        return yaml.safe_load(f)

lib/galaxy/util/properties.py

@@ -67,7 +67,7 @@ def load_app_properties(
                 config_section = "galaxy"
 
             with open(config_file, "r") as f:
-                raw_properties = yaml.load(f)
+                raw_properties = yaml.safe_load(f)
             properties = raw_properties[config_section] or {}
 
     override_prefix = "%sOVERRIDE_" % config_prefix

lib/galaxy/visualization/plugins/interactive_environments.py

@@ -111,7 +111,7 @@ class InteractiveEnvironmentRequest(object):
                 raise Exception("[{0}] Could not find allowed_images.yml, or image tag in {0}.ini file for ".format(self.attr.viz_id))
 
         with open(fn, 'r') as handle:
-            self.allowed_images = [x['image'] for x in yaml.load(handle)]
+            self.allowed_images = [x['image'] for x in yaml.safe_load(handle)]
 
             if len(self.allowed_images) == 0:
                 raise Exception("No allowed images specified for " + self.attr.viz_id)

lib/galaxy/webapps/config_manage.py

@@ -670,7 +670,7 @@ def _ordered_load(stream):
         def include(self, node):
             filename = os.path.join(self._root, self.construct_scalar(node))
             with open(filename, 'r') as f:
-                return yaml.load(f, OrderedLoader)
+                return yaml.safe_load(f, OrderedLoader)
 
     def construct_mapping(loader, node):
         loader.flatten_mapping(node)
@@ -681,7 +681,7 @@ def _ordered_load(stream):
         construct_mapping)
     OrderedLoader.add_constructor('!include', OrderedLoader.include)
 
-    return yaml.load(stream, OrderedLoader)
+    return yaml.safe_load(stream, OrderedLoader)
 
 
 def _ordered_dump(data, stream=None, Dumper=yaml.Dumper, **kwds):

lib/galaxy/webapps/galaxy/api/users.py

@@ -282,7 +282,7 @@ class UserAPIController(BaseAPIController, UsesTagsMixin, CreatesUsersMixin, Cre
         path = trans.app.config.user_preferences_extra_config_file
         try:
             with open(path, 'r') as stream:
-                config = yaml.load(stream)
+                config = yaml.safe_load(stream)
         except:
             log.warning('Config file (%s) could not be found or is malformed.' % path)
             return {}

lib/galaxy/webapps/galaxy/controllers/visualization.py

@@ -961,7 +961,7 @@ class VisualizationController(BaseUIController, SharableMixin, UsesVisualization
                         continue
 
                     with open(image_file, 'r') as handle:
-                        self.gie_image_map[gie] = yaml.load(handle)
+                        self.gie_image_map[gie] = yaml.safe_load(handle)
 
         return trans.fill_template_mako(
             "visualization/gie.mako",

lib/galaxy/webhooks/__init__.py

@@ -64,7 +64,7 @@ class WebhooksRegistry(object):
     def load_webhook_from_config(self, config_dir, config_file):
         try:
             with open(os.path.join(config_dir, config_file)) as file:
-                config = yaml.load(file)
+                config = yaml.safe_load(file)
                 path = os.path.normpath(os.path.join(config_dir, '..'))
                 webhook = Webhook(
                     config['name'],

scripts/grt/export.py

@@ -191,11 +191,11 @@ def main(argv):
     annotate('init_start', 'Loading GRT configuration...')
     try:
         with open(args.config) as handle:
-            config = yaml.load(handle)
+            config = yaml.safe_load(handle)
     except Exception:
         logging.info('Using default GRT configuration')
         with open(sample_config) as handle:
-            config = yaml.load(handle)
+            config = yaml.safe_load(handle)
     annotate('init_end')
 
     REPORT_DIR = args.report_directory

scripts/grt/upload.py

@@ -28,11 +28,11 @@ def main(argv):
     logging.info('Loading GRT configuration...')
     try:
         with open(args.config) as handle:
-            config = yaml.load(handle)
+            config = yaml.safe_load(handle)
     except Exception:
         logging.info('Using default GRT configuration')
         with open(sample_config) as handle:
-            config = yaml.load(handle)
+            config = yaml.safe_load(handle)
 
     REPORT_DIR = args.report_directory
     GRT_URL = config['grt']['url'].rstrip('/') + '/'

test/api/test_workflows.py

@@ -172,7 +172,7 @@ class BaseWorkflowsApiTestCase(api.ApiTestCase):
         )
         if jobs_descriptions is None:
             assert source_type != "path"
-            jobs_descriptions = yaml.load(has_workflow)
+            jobs_descriptions = yaml.safe_load(has_workflow)
 
         test_data = jobs_descriptions.get("test_data", {})
 

test/api/test_workflows_from_yaml.py

@@ -55,11 +55,11 @@ steps:
         assert tool_count['random_lines1'] == 1
         assert tool_count['cat1'] == 2
 
-# FIXME:  This test fails on some machines due to (we're guessing) yaml loading
+# FIXME:  This test fails on some machines due to (we're guessing) yaml.safe_loading
 # order being not guaranteed and inconsistent across platforms.  The workflow
-# yaml loader probably needs to enforce order using something like the
+# yaml.safe_loader probably needs to enforce order using something like the
 # approach described here:
-# https://stackoverflow.com/questions/13297744/pyyaml-control-ordering-of-items-called-by-yaml-load
+# https://stackoverflow.com/questions/13297744/pyyaml-control-ordering-of-items-called-by-yaml.safe_load
 #     def test_multiple_input( self ):
 #         history_id = self.dataset_populator.new_history()
 #         self._run_jobs("""

test/base/workflows_format_2/converter.py

@@ -32,7 +32,7 @@ RUN_ACTIONS_TO_STEPS = {
 
 def yaml_to_workflow(has_yaml, galaxy_interface, workflow_directory):
     """Convert a Format 2 workflow into standard Galaxy format from supplied stream."""
-    as_python = yaml.load(has_yaml)
+    as_python = yaml.safe_load(has_yaml)
     return python_to_workflow(as_python, galaxy_interface, workflow_directory)
 
 
@@ -109,7 +109,7 @@ def _python_to_workflow(as_python, conversion_context):
                 run_action_path = run_action["@import"]
                 runnable_path = os.path.join(conversion_context.workflow_directory, run_action_path)
                 with open(runnable_path, "r") as f:
-                    runnable_description = yaml.load(f)
+                    runnable_description = yaml.safe_load(f)
                     run_action = runnable_description
 
             run_class = run_action["class"]

test/base/workflows_format_2/main.py

@@ -20,7 +20,7 @@ def convert_and_import_workflow(has_workflow, **kwds):
         if workflow_directory is None:
             workflow_directory = os.path.dirname(has_workflow)
         with open(workflow_path, "r") as f:
-            has_workflow = yaml.load(f)
+            has_workflow = yaml.safe_load(f)
 
     if workflow_directory is not None:
         workflow_directory = os.path.abspath(workflow_directory)

test/galaxy_selenium/data.py

@@ -3,4 +3,4 @@ from pkg_resources import resource_string
 import yaml
 
 data_yaml = resource_string(__name__, 'navigation-data.yml').decode("UTF-8")
-NAVIGATION_DATA = yaml.load(data_yaml)
+NAVIGATION_DATA = yaml.safe_load(data_yaml)

test/galaxy_selenium/navigates_galaxy.py

@@ -798,7 +798,7 @@ class NavigatesGalaxy(HasDriver):
         self.home()
 
         with open(path, "r") as f:
-            tour_dict = yaml.load(f)
+            tour_dict = yaml.safe_load(f)
         steps = tour_dict["steps"]
         for i, step in enumerate(steps):
             title = step.get("title", None)

test/unit/workflows/workflow_support.py

@@ -75,7 +75,7 @@ class TestToolbox(object):
 
 def yaml_to_model(has_dict, id_offset=100):
     if isinstance(has_dict, str):
-        has_dict = yaml.load(has_dict)
+        has_dict = yaml.safe_load(has_dict)
 
     workflow = model.Workflow()
     workflow.steps = []