Load YAML safely

Author: PeterJCLaw

scripts/import.py

@@ -42,7 +42,7 @@ def process(element_name: str, *, year: str, handle_dep: Callable[[str], int]) -
     data = data.replace('$YYYY', str(year))
     data = data.replace('$SRYYYY', f'SR{year}')
 
-    raw_elements = yaml.load(data)
+    raw_elements = yaml.safe_load(data)
     if 'summary' not in raw_elements and 'description' not in raw_elements:
         raise RuntimeError(f"{path} contains neither a summary nor a description")
 

scripts/validate-reachability.py

@@ -27,7 +27,7 @@ def strip_dot_yaml(text: str) -> str:
     linked.add(element)
     try:
         with Path(element).with_suffix('.yaml').open() as f:
-            data = yaml.load(f)
+            data = yaml.safe_load(f)
         for dependency in data.get('dependencies', ()):
             if dependency not in linked:
                 worklist.add(dependency)