HAL9000
021d09991a
Three step patterns in pyyaml_security_steps.py clashed with existing step files, causing all Behave features to error at load time: - "I call load_yaml_text with YAML text" clashed with actor_config_coverage_boost_steps.py:103 - "the load_yaml_text result should have key" clashed with actor_config_coverage_boost_steps.py:90 - "a ValueError should be raised" clashed with lsp_registry_steps.py:475 Rename all three to unique patterns and update pyyaml_security.feature to match. Also fix typings/behave/runner.pyi ruff format (.pyi convention: single blank line before class, no blank lines between stub methods) and add missing fastapi>=0.100.0 to pyproject.toml (asgi_app.py imports fastapi but it was absent from declared dependencies, causing typecheck and integration test failures). Refs: #9055
19 lines
965 B
Gherkin
19 lines
965 B
Gherkin
Feature: PyYAML security constraint
|
|
Verify that PyYAML is pinned to a secure version and that all YAML loading
|
|
in the codebase uses safe_load to prevent arbitrary code execution.
|
|
See issue #9055: CVE-2017-18342 mitigation.
|
|
|
|
Scenario: PyYAML version meets the minimum secure version constraint
|
|
Given the PyYAML package is installed
|
|
When I check the installed PyYAML version
|
|
Then the version should be at least 6.0.3
|
|
|
|
Scenario: yaml_loader uses safe_load for plain YAML input
|
|
When I load the YAML text "provider: anthropic\nmodel: claude-3-5-sonnet\n" using the secure yaml_loader
|
|
Then the secure yaml_loader result for key "provider" should be "anthropic"
|
|
And the secure yaml_loader result for key "model" should be "claude-3-5-sonnet"
|
|
|
|
Scenario: yaml_loader rejects YAML with Python object tags
|
|
When I call load_yaml_text with unsafe YAML containing a Python object tag
|
|
Then a pyyaml security ValueError should be raised
|