Build: Fix deprecated yaml.load calls
PyYAML's yaml.load() function provides arbitrary code execution before
PyYAML v4.1 and is therefore deprecated - as of v5.1 - with a single
file argument as described in
https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
Use yaml.SafeLoader in TF-M generator scripts.
Change-Id: I9eee8805053dd653fca946c4376be3eebd4bfd53
Signed-off-by: Mate Toth-Pal <mate.toth-pal@arm.com>
diff --git a/tools/tfm_parse_manifest_list.py b/tools/tfm_parse_manifest_list.py
index 071fa78..19aa4c2 100644
--- a/tools/tfm_parse_manifest_list.py
+++ b/tools/tfm_parse_manifest_list.py
@@ -63,12 +63,12 @@
parser.
"""
db = []
- manifest_list = yaml.load(file)
+ manifest_list = yaml.safe_load(file)
for item in manifest_list["manifest_list"]:
manifest_path = item['manifest']
try:
file = open(manifest_path)
- manifest = yaml.load(file)
+ manifest = yaml.safe_load(file)
db.append({"manifest": manifest, "attr": item})
except IOError:
raise Exception ("Manifest for "+item['name']+" cannot be opened at path "+item['manifest'])
@@ -86,14 +86,14 @@
"""
manifest_header_list = []
with open(manifest_list_yaml_file_path) as manifest_list_yaml_file:
- manifest_list = yaml.load(manifest_list_yaml_file)
+ manifest_list = yaml.safe_load(manifest_list_yaml_file)
templatefile_name = 'secure_fw/services/manifestfilename.template'
template = env.get_template(templatefile_name)
for manifest_file in manifest_list["manifest_list"]:
manifest_path = manifest_file['manifest']
file = open(manifest_path)
- manifest = yaml.load(file)
+ manifest = yaml.safe_load(file)
utilities = {}
utilities['donotedit_warning']=donotedit_warning
@@ -156,7 +156,7 @@
with open(os.path.join('tools', 'tfm_generated_file_list.yaml')) \
as file_list_yaml_file:
# read list of files that need to be generated from templates using db
- file_list_yaml = yaml.load(file_list_yaml_file)
+ file_list_yaml = yaml.safe_load(file_list_yaml_file)
file_list = file_list_yaml["file_list"]
for file in file_list:
outfile_name = file["output"]