Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-16 23:05:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1469999 - Use yaml.safe_load() for loading clang-tidy config file; r=chmanchester

Browse Source 
yaml.load() isn't secure.

--HG--
extra : rebase_source : 03eb1715acd62ab8c98bf4d850cc39a88140a998
extra : histedit_source : 8b3b4823c1f1c20be58494a5f98041e7c46ca3b4
This commit is contained in:
Gregory Szorc 2018-06-20 14:29:06 -07:00
parent 3f4ac974d3
commit 871e349399
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
python/mozbuild/mozbuild/mach_commands.py
View File

@ -1769,7 +1769,7 @@ class StaticAnalysis(MachCommandBase):
# For each checker run it
f = open(mozpath.join(self._clang_tidy_base_path, "config.yaml"))
import yaml
config = yaml.load(f)
config = yaml.safe_load(f)
platform, _ = self.platform
if platform not in config['platforms']:
@ -1970,7 +1970,7 @@ class StaticAnalysis(MachCommandBase):
import yaml
with open(mozpath.join(self.topsrcdir, "tools", "clang-tidy", "config.yaml")) as f:
try:
config = yaml.load(f)
config = yaml.safe_load(f)
for item in config['clang_checkers']:
if item['publish']:
checks += ',' + item['name']