Use yaml.safe_load instead of load.

yaml.load will execute arbitrary code.

Also use context managers to ensure files are closed

Change-Id: I704baa7916ee834c12821009d8e3029b1b8fa340

1 files changed, 4 insertions, 2 deletions

diff --git a/os_client_config/config.py b/os_client_config/config.py
index 925c23f..c711919 100644
--- a/os_client_config/config.py
+++ b/os_client_config/config.py
@@ -87,12 +87,14 @@ class OpenStackConfig(object):
     def _load_config_file(self):
         for path in self._config_files:
             if os.path.exists(path):
-                return yaml.load(open(path, 'r'))
+                with open(path, 'r') as f:
+                    return yaml.safe_load(f)
 
     def _load_vendor_file(self):
         for path in self._vendor_files:
             if os.path.exists(path):
-                return yaml.load(open(path, 'r'))
+                with open(path, 'r') as f:
+                    return yaml.safe_load(f)
 
     def get_cache_max_age(self):
         return self._cache_max_age