...
CII Badge Security Considerations
VVP is a set of python scripts executed locally, without communication over the network. The interface provided to users is via cli, and yaml documents are loaded and linted according to the VNF Heat Template Guidelines.
This introduces one potential security concern, which is the loading of potentially unknown yaml documents on a users machine. According to the PyYaml documentation:
Warning: It is not safe to call yaml.load
with any data received from an untrusted source! yaml.load
is as powerful as pickle.load
and so may call any Python function. Check the yaml.safe_load
function though.
In 2018, vvp validation scripts were updated to use the PyYaml safe_load method to mitigate the potential for executing arbitrary python functions.
Bug reports :
Raise a bug report against the vvp project in the ONAP JIRA
...