From 8544fca20db51956c1f9a986a65f2c621907fe00 Mon Sep 17 00:00:00 2001 From: Aditya Chhabra Date: Mon, 17 Nov 2025 19:23:09 +0530 Subject: [PATCH] fix: replace yaml.dump() with yaml.safe_dump() to prevent serialization of malicious objects --- src/cleveragents/templates/deferred_template.py | 2 +- src/cleveragents/templates/enhanced_registry.py | 2 +- src/cleveragents/templates/template_store.py | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/cleveragents/templates/deferred_template.py b/src/cleveragents/templates/deferred_template.py index 468cbebd7..ad5b4c432 100644 --- a/src/cleveragents/templates/deferred_template.py +++ b/src/cleveragents/templates/deferred_template.py @@ -60,7 +60,7 @@ class DeferredTemplate: return None # Convert the section back to YAML string - section_yaml = yaml.dump({key: yaml_dict[key]}, default_flow_style=False) + section_yaml = yaml.safe_dump({key: yaml_dict[key]}, default_flow_style=False) # Check if it contains template syntax if "{%" in section_yaml or "{{" in section_yaml: diff --git a/src/cleveragents/templates/enhanced_registry.py b/src/cleveragents/templates/enhanced_registry.py index 8d033eed9..60f6933bb 100644 --- a/src/cleveragents/templates/enhanced_registry.py +++ b/src/cleveragents/templates/enhanced_registry.py @@ -89,7 +89,7 @@ class EnhancedTemplateRegistry: definition: Template definition dictionary """ # Check if the definition contains Jinja2 syntax - yaml_str = yaml.dump(definition, default_flow_style=False) + yaml_str = yaml.safe_dump(definition, default_flow_style=False) if "{%" in yaml_str or "{{" in yaml_str: # Contains templates, store as string diff --git a/src/cleveragents/templates/template_store.py b/src/cleveragents/templates/template_store.py index 685df2700..666160f4b 100644 --- a/src/cleveragents/templates/template_store.py +++ b/src/cleveragents/templates/template_store.py @@ -60,7 +60,7 @@ class TemplateStore: logger.warning("Could not parse metadata for %s/%s", template_type, name) else: # Convert to YAML string for storage - yaml_str = yaml.dump(definition, default_flow_style=False) + yaml_str = yaml.safe_dump(definition, default_flow_style=False) self.raw_templates[template_type][name] = yaml_str self._extract_metadata(template_type, name, definition) @@ -151,7 +151,7 @@ class TemplateDefinition: self.parsed = {} else: self.parsed = definition - self.raw_yaml = yaml.dump(definition, default_flow_style=False) + self.raw_yaml = yaml.safe_dump(definition, default_flow_style=False) # Check for template syntax if not explicitly set if not contains_templates: -- 2.52.0