Fixed previous yaml load commit and added a tox.ini file.

DETAILS:
- Apparently a potential security issue with yaml.load vs yaml.safe_load.
  Like pickling, yaml.load could result in arbitrary code being run.
- tox.ini file includes the flake8 settings for this project, build spec for 2.7
  and line for eventually testing the project.
This commit is contained in:
Rory Finnegan 2014-04-15 19:31:04 -05:00
parent e25276367b
commit 708c3d589e
3 changed files with 13 additions and 1 deletions

2
.gitignore vendored
View file

@ -8,3 +8,5 @@ _site/
/build
/dist
/bootstrap_vz.egg-info
/.tox
/.coverage

View file

@ -67,7 +67,7 @@ def load_json(path):
def load_yaml(path):
import yaml
with open(path, 'r') as fobj:
return yaml.load(fobj)
return yaml.safe_load(fobj)
def config_get(path, config_path):

10
tox.ini Normal file
View file

@ -0,0 +1,10 @@
[flake8]
ignore = E101,E221,E241,E501,W191
max-line-length = 110
[tox]
envlist = py27
[testenv]
# Once tests have started being written, uncomment this to run tests when running tox.
#commands = nosetests -v tests --with-coverage --cover-package=bootstrapvz --cover-inclusive