mirror of
https://github.com/astral-sh/ruff.git
synced 2025-10-01 14:21:53 +00:00
edfad461a8
## Summary
Hey there 👋 thanks for this great project!
On python code looking like the following
```
import yaml
from yaml.loader import SafeLoader
with MY_FILE_PATH.open("r") as my_file:
my_data = yaml.load(my_file, Loader=SafeLoader)
```
ruff reports this error:
```
S506 Probable use of unsafe loader `SafeLoader` with `yaml.load`. Allows instantiation of arbitrary objects. Consider `yaml.safe_load`.
```
This PR is an attempt to support SafeLoader being imported for either
`yaml` or `yaml.loader`
Disclaimer:
I am not familiar with Rust so this is likely not the better way of
doing it. Interested in hearing how to adapt this PR to provide similar
behavior in a better way
## Test Plan
The S506.py file was updated accordingly to cover the use cases and test
were confirmed to pass with this change.
36 lines
941 B
Python
36 lines
941 B
Python
import json
|
|
import yaml
|
|
from yaml import CSafeLoader
|
|
from yaml import SafeLoader
|
|
from yaml.loader import SafeLoader as NewSafeLoader
|
|
|
|
|
|
def test_yaml_load():
|
|
ystr = yaml.dump({"a": 1, "b": 2, "c": 3})
|
|
y = yaml.load(ystr)
|
|
yaml.dump(y)
|
|
try:
|
|
y = yaml.load(ystr, Loader=yaml.CSafeLoader)
|
|
except AttributeError:
|
|
# CSafeLoader only exists if you build yaml with LibYAML
|
|
y = yaml.load(ystr, Loader=yaml.SafeLoader)
|
|
|
|
|
|
def test_json_load():
|
|
# no issue should be found
|
|
j = json.load("{}")
|
|
|
|
|
|
yaml.load("{}", Loader=yaml.Loader)
|
|
|
|
# no issue should be found
|
|
yaml.load("{}", SafeLoader)
|
|
yaml.load("{}", yaml.SafeLoader)
|
|
yaml.load("{}", CSafeLoader)
|
|
yaml.load("{}", yaml.CSafeLoader)
|
|
yaml.load("{}", NewSafeLoader)
|
|
yaml.load("{}", Loader=SafeLoader)
|
|
yaml.load("{}", Loader=yaml.SafeLoader)
|
|
yaml.load("{}", Loader=CSafeLoader)
|
|
yaml.load("{}", Loader=yaml.CSafeLoader)
|
|
yaml.load("{}", Loader=NewSafeLoader)
|