lib/puppet/network/formats.rb in puppet-2.7.20 vs lib/puppet/network/formats.rb in puppet-2.7.21

@@ -1,16 +1,16 @@
 require 'puppet/network/format_handler'
 
 Puppet::Network::FormatHandler.create_serialized_formats(:yaml) do
   # Yaml doesn't need the class name; it's serialized.
   def intern(klass, text)
-    YAML.load(text)
+    YAML.safely_load(text)
   end
 
   # Yaml doesn't need the class name; it's serialized.
   def intern_multiple(klass, text)
-    YAML.load(text)
+    YAML.safely_load(text)
   end
 
   def render(instance)
     instance.to_yaml
   end
@@ -70,10 +70,10 @@
     end
   end
 
   def decode(yaml)
     requiring_zlib do
-      YAML.load(Zlib::Inflate.inflate(Base64.decode64(yaml)))
+      YAML.safely_load(Zlib::Inflate.inflate(Base64.decode64(yaml)))
     end
   end
 end
 
 Puppet::Network::FormatHandler.create(:s, :mime => "text/plain", :extension => "txt")