codecov[bot]: # [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=h1) Report
> Merging [#42](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=desc) into [master](https://codecov.io/gh/Stranger6667/pyanyapi/commit/aebee636ad26f387850a6c8ab820ce4aac3f9adb?src=pr&el=desc) will **decrease** coverage by `1.85%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42/graphs/tree.svg?height=150&width=650&token=WWPz6pWARM&src=pr)](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master      #42      +/-   ##
==========================================
- Coverage   99.46%   97.61%   -1.86%     
==========================================
  Files           7        7              
  Lines         377      377              
  Branches       42       42              
==========================================
- Hits          375      368       -7     
- Misses          2        9       +7
```


| [Impacted Files](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pyanyapi/interfaces.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvaW50ZXJmYWNlcy5weQ==) | `100% <100%> (ø)` | :arrow_up: |
| [pyanyapi/\_compat.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvX2NvbXBhdC5weQ==) | `58.82% <0%> (-41.18%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=footer). Last update [aebee63...6fcd23b](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

codecov[bot]: # [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=h1) Report
> Merging [#42](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=desc) into [master](https://codecov.io/gh/Stranger6667/pyanyapi/commit/aebee636ad26f387850a6c8ab820ce4aac3f9adb?src=pr&el=desc) will **decrease** coverage by `1.85%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42/graphs/tree.svg?height=150&width=650&src=pr&token=WWPz6pWARM)](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master      #42      +/-   ##
==========================================
- Coverage   99.46%   97.61%   -1.86%     
==========================================
  Files           7        7              
  Lines         377      377              
  Branches       42       42              
==========================================
- Hits          375      368       -7     
- Misses          2        9       +7
```


| [Impacted Files](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [pyanyapi/interfaces.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvaW50ZXJmYWNlcy5weQ==) | `100% <100%> (ø)` | :arrow_up: |
| [pyanyapi/\_compat.py](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=tree#diff-cHlhbnlhcGkvX2NvbXBhdC5weQ==) | `58.82% <0%> (-41.18%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=footer). Last update [aebee63...6fcd23b](https://codecov.io/gh/Stranger6667/pyanyapi/pull/42?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

diff --git a/.travis.yml b/.travis.yml
index 1975b26..b7b5b14 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,17 +1,30 @@
 language: python
 python:
   - 3.5
-env:
-  - TOX_ENV=py26
-  - TOX_ENV=py27
-  - TOX_ENV=py32
-  - TOX_ENV=py33
-  - TOX_ENV=py34
-  - TOX_ENV=py35
-  - TOX_ENV=pypy
-  - TOX_ENV=pypy3
-  - JYTHON=true
+matrix:
+  fast_finish: true
+  include:
+    - python: 3.5
+      env: TOX_ENV=py35
+    - python: 3.4
+      env: TOX_ENV=py34
+    - python: 3.3
+      env: TOX_ENV=py33
+    - python: 3.2
+      env: TOX_ENV=py32
+    - python: 2.7
+      env: TOX_ENV=py27
+    - python: 2.6
+      env: TOX_ENV=py26
+    - python: pypy
+      env: TOX_ENV=pypy
+    - python: pypy3
+      env: TOX_ENV=pypy3
+    - python: 3.5
+      env: $JYTHON=true
 install:
+  - if [ $TOX_ENV = "py32" ]; then travis_retry pip install "virtualenv<14.0.0" "tox<1.8.0"; fi
+  - if [ $TOX_ENV = "pypy3" ]; then travis_retry pip install "virtualenv<14.0.0" "tox<1.8.0"; fi
   - if [ -z "$JYTHON" ]; then pip install codecov; fi
   - if [ "$TOX_ENV" ]; then travis_retry pip install "virtualenv<14.0.0" tox; fi
 before_install:
@@ -22,4 +35,4 @@ script:
   - if [ "$JYTHON" ]; then travis_retry jython setup.py test; fi
   - if [ "$TOX_ENV" ]; then tox -e $TOX_ENV; fi
 after_success:
-  - codecov
\ No newline at end of file
+  - codecov
diff --git a/pyanyapi/interfaces.py b/pyanyapi/interfaces.py
index 698c637..c0914b2 100644
--- a/pyanyapi/interfaces.py
+++ b/pyanyapi/interfaces.py
@@ -274,7 +274,7 @@ class YAMLInterface(DictInterface):
 
     def perform_parsing(self):
         try:
-            return yaml.load(self.content)
+            return yaml.safe_load(self.content)
         except yaml.error.YAMLError:
             raise ResponseParseError(self._error_message, self.content)
 

YAMLParser method is vulnerable 
from pyanyapi import YAMLParser
YAMLParser({'test': 'container > test'}).parse('!!python/object/apply:os.system ["calc.exe"]').test

Hi, there is a vulnerability in YAMLParser method in Interfaces.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.
diff --git a/tests/test_parsers.py b/tests/test_parsers.py
index 38223e2..4958b21 100644
--- a/tests/test_parsers.py
+++ b/tests/test_parsers.py
@@ -63,6 +63,15 @@ def test_yaml_parser_error():
         parsed.test
 
 
+def test_yaml_parser_vulnerability():
+    """
+    In case of usage of yaml.load `test` value will be equal to 0.
+    """
+    parsed = YAMLParser({'test': 'container > test'}).parse('!!python/object/apply:os.system ["exit 0"]')
+    with pytest.raises(ResponseParseError):
+        parsed.test
+
+
 @lxml_is_supported
 @pytest.mark.parametrize(
     'settings', (

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-cov
3.5
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs==22.2.0
certifi==2021.5.30
coverage==6.2
importlib-metadata==4.8.3
iniconfig==1.1.1
lxml==5.3.1
packaging==21.3
pluggy==1.0.0
py==1.11.0
-e git+https://github.com/Stranger6667/pyanyapi.git@aebee636ad26f387850a6c8ab820ce4aac3f9adb#egg=pyanyapi
pyparsing==3.1.4
pytest==7.0.1
pytest-cov==4.0.0
PyYAML==6.0.1
tomli==1.2.3
typing_extensions==4.1.1
ujson==4.3.0
zipp==3.6.0

name: pyanyapi
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - attrs==22.2.0
      - coverage==6.2
      - importlib-metadata==4.8.3
      - iniconfig==1.1.1
      - lxml==5.3.1
      - packaging==21.3
      - pluggy==1.0.0
      - py==1.11.0
      - pyparsing==3.1.4
      - pytest==7.0.1
      - pytest-cov==4.0.0
      - pyyaml==6.0.1
      - tomli==1.2.3
      - typing-extensions==4.1.1
      - ujson==4.3.0
      - zipp==3.6.0
prefix: /opt/conda/envs/pyanyapi

tests/test_parsers.py::test_yaml_parser_error tests/test_parsers.py::test_yaml_parser_vulnerability tests/test_parsers.py::test_yaml_parse
tests/test_parsers.py::test_xml_objectify_parser tests/test_parsers.py::test_xml_objectify_parser_error tests/test_parsers.py::test_xml_parser_error tests/test_parsers.py::test_xml_parsed[settings0] tests/test_parsers.py::test_xml_parsed[settings1] tests/test_parsers.py::test_xml_simple_settings tests/test_parsers.py::test_json_parsed tests/test_parsers.py::test_multiple_parser_join tests/test_parsers.py::test_multiply_parsers_declaration tests/test_parsers.py::test_empty_values[{"container":{"test":"value"}}-test-value] tests/test_parsers.py::test_empty_values[{"container":{"test":"value"}}-second-None] tests/test_parsers.py::test_empty_values[{"container":{"fail":[1]}}-second-None] tests/test_parsers.py::test_empty_values[{"container":[[1],[],[3]]}-third-expected3] tests/test_parsers.py::test_empty_values[{"container":null}-null-None] tests/test_parsers.py::test_empty_values[{"container":[1,2]}-test-1,2] tests/test_parsers.py::test_attributes tests/test_parsers.py::test_efficient_parsing tests/test_parsers.py::test_simple_config_xml_parser tests/test_parsers.py::test_simple_config_json_parser tests/test_parsers.py::test_settings_inheritance tests/test_parsers.py::test_complex_config tests/test_parsers.py::test_json_parse tests/test_parsers.py::test_json_value_error_parse tests/test_parsers.py::test_regexp_parse tests/test_parsers.py::test_ajax_parser tests/test_parsers.py::test_ajax_parser_cache tests/test_parsers.py::test_ajax_parser_invalid_settings tests/test_parsers.py::test_parse_memoization tests/test_parsers.py::test_regexp_settings tests/test_parsers.py::test_parse_all tests/test_parsers.py::test_parse_all_combined_parser tests/test_parsers.py::test_parse_csv tests/test_parsers.py::test_parse_csv_custom_delimiter tests/test_parsers.py::test_csv_parser_error tests/test_parsers.py::test_children[SubParser] tests/test_parsers.py::test_children[sub_parser1] tests/test_parsers.py::TestIndexOfParser::test_default[foo-b\xe1r] tests/test_parsers.py::TestIndexOfParser::test_default[foo-b\xc3\xa1r] tests/test_parsers.py::TestIndexOfParser::test_parsing_error[has_bar] tests/test_parsers.py::TestIndexOfParser::test_parsing_error[has_baz]
pyanyapi/interfaces.py .travis.yml
pyanyapi/interfaces.py .travis.yml