RCE Fixed (#3402)

Co-authored-by: Anon-Artist <61599526+Anon-Artist@users.noreply.github.com> Co-authored-by: Jamie Slome <jamie@418sec.com>
facebookresearch · Jan 26, 2021 · 507d066 · 507d066
1 parent c2c800e
commit 507d066
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/parlai/chat_service/utils/config.py b/parlai/chat_service/utils/config.py
@@ -36,7 +36,7 @@ def parse_configuration_file(config_path):
     result = {}
     result["configs"] = {}
     with open(config_path) as f:
-        cfg = yaml.load(f.read(), Loader=yaml.FullLoader)
+        cfg = yaml.load(f.read(), Loader=yaml.SafeLoader)
         # get world path
         result["world_path"] = cfg.get("world_module")
         if not result["world_path"]: