FIX: avoid CVE-2017-18342

[hoxnox]

boost/1.73.0

• I've read the guidelines for contributing.
• I've followed the PEP8 style guides for Python code in the recipes.
• I've used the latest Conan client version.
• I've tried at least one configuration locally with the
  conan-center hook activated.

Usage of pyyaml::load is unsafe.
Gentoo blocks these calls if pyyaml installed through portage.
See https://bugs.gentoo.org/659348

[ghost]

I detected other pull requests that are modifying boost/all recipe:

• [boost] b2 user-config.jam needs CXX binary to be quoted as path may contain spaces #4149
• [boost] debug_level=0 should emit -d0 #4121
• [boost] Allow apple-clang version 10 for nowide and C++ 11 #3977
• Boost/1.72.0/mpi #3959
• boost: patch serialization sources #3918
• Boost: Change assertions to warnings #3900
• Add --disable-icu flag for iconv backend #3855
• boost: Correct --disable-iconv option #2657

This message is automatically generated by https://github.com/ericLemanissier/conan-center-conflicting-prs so don't hesitate to report issues/improvements there.

[conan-center-bot]

All green in build 1 (04c5e7deee9442f388c5826e69303c141a340416)! 😊

• boost/1.69.0: Generated 131 packages. All logs here
• boost/1.70.0: Generated 131 packages. All logs here
• boost/1.71.0: Generated 131 packages. All logs here
• boost/1.72.0: Generated 131 packages. All logs here
• boost/1.73.0: Generated 131 packages. All logs here
• boost/1.74.0: Generated 131 packages. All logs here
• boost/1.75.0: Generated 131 packages. All logs here

[prince-chrismc]

Looks to easy... what's the side effect? why did they make a new function instead of fixing the old one?

[hoxnox]

Looks to easy... what's the side effect? why did they make a new function instead of fixing the old one?

In this particular case there is no side effects. The author of pyyml deside to fix possible RCE with new function safe_load and warning in load. Gentoo community deside to block this function in the portage version of the library.

[SSE4]

maybe we should block unsafe python calls via hooks as well, to prevent such situations?
are there other examples besides yaml.load? is there a list available somewhere?

[hoxnox]

is there a list available somewhere?

I don't know such lists.
Maybe there is a security linter for python.
Or static vulnerability scanner.

But I think this is overkill in this software. Conan recipes checks what they download to execute through checksums.

In this particular case I didn't care about security. My gentoo system fails with error with this recipe if conan installed through portage system with portage dependecies (pyyaml in gentoo patched).

[SSE4]

we have two occurances now:

./recipes/boost/all/conanfile.py:165:        return yaml.load(open(dependencies_filepath))
./recipes/open62541/all/conanfile.py:170:            submodules_data = yaml.load(submodule_stream)

need to open PR for open62541 as well

[conan-center-bot]

All green in build 2 (04c5e7deee9442f388c5826e69303c141a340416)! 😊

• boost/1.69.0: Generated 131 packages. All logs here
• boost/1.70.0: Generated 131 packages. All logs here
• boost/1.71.0: Generated 131 packages. All logs here
• boost/1.72.0: Generated 131 packages. All logs here
• boost/1.73.0: Generated 131 packages. All logs here
• boost/1.74.0: Generated 131 packages. All logs here
• boost/1.75.0: Generated 131 packages. All logs here

[hoxnox]

we have two occurances now:

./recipes/boost/all/conanfile.py:165:        return yaml.load(open(dependencies_filepath))
./recipes/open62541/all/conanfile.py:170:            submodules_data = yaml.load(submodule_stream)

need to open PR for open62541 as well

That good news, I thought there will be much more.
Later I'll make a PR. Thanks.

[prince-chrismc]

👍 https://bugs.gentoo.org/659348

[prince-chrismc]

Now I am confused, safe_load === load 🤔

https://github.com/yaml/pyyaml/pull/74/files

[Croydon]

Now I am confused, safe_load === load 🤔

https://github.com/yaml/pyyaml/pull/74/files

Looks like this is only a problem with old pyyaml versions then. Hence, I think we have no need for another hook for this

[hoxnox]

Now I am confused, safe_load === load thinking
https://github.com/yaml/pyyaml/pull/74/files

Looks like this is only a problem with old pyyaml versions then. Hence, I think we have no need for another hook for this

yah, I should try to force gentoo comunity fix ebuild in portage

tail -n 19 pyyaml-5.3.1-r1.ebuild | head -n 6

PATCHES=(
        # bug #659348
        "${FILESDIR}/pyyaml-5.1-cve-2017-18342.patch"
)