Update pyyaml to fix build failure with Python 3.9

[thopre]

Summary

Upgrade pyyaml to the latest bugfix release for the next stable version:
5.1.2. This fixes a build failure when Python is 3.9. This requires
migrating to yaml.safe_load to avoid warnings due to the use of unsafe
load() method.

[tnfchris]

Hmm the last time I upgraded pyyaml it started complaining about the interface we're using being insecure and a security issue. is that no longer the case?

I remember it required slight tweaking.

[thopre]

In D109226#2982029, @tnfchris wrote:

Hmm the last time I upgraded pyyaml it started complaining about the interface we're using being insecure and a security issue. is that no longer the case?

I remember it required slight tweaking.

I didn't get any warning, except for pip complaining about being run as root but that's a separate issue

[tnfchris]

In D109226#2982046, @thopre wrote:

In D109226#2982029, @tnfchris wrote:

Hmm the last time I upgraded pyyaml it started complaining about the interface we're using being insecure and a security issue. is that no longer the case?

I remember it required slight tweaking.

I didn't get any warning, except for pip complaining about being run as root but that's a separate issue

Hmm ok, It should be giving this warning https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation when LNT starts up.

But if you don't see it they might have did something to not require it.. so LGTM then.

[kragniz]

Running tox with this change results in the warning appearing, for example:

~/git/llvm-lnt/.tox/py3/lib/python3.6/site-packages/lnt/lnttool/admin.py:53: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.

I'd recommend switching the couple of yaml.load calls with yaml.safe_load.

[thopre]

Move to yaml safe_load() method instead of load()

[thopre]

In D109226#2982067, @tnfchris wrote:

In D109226#2982046, @thopre wrote:

In D109226#2982029, @tnfchris wrote:

Hmm the last time I upgraded pyyaml it started complaining about the interface we're using being insecure and a security issue. is that no longer the case?

I remember it required slight tweaking.

I didn't get any warning, except for pip complaining about being run as root but that's a separate issue

Hmm ok, It should be giving this warning https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation when LNT starts up.

But if you don't see it they might have did something to not require it.. so LGTM then.

Builds and runs without warning for the current alpine base image (based on Python 3.7).

In D109226#2982067, @tnfchris wrote:

In D109226#2982046, @thopre wrote:

In D109226#2982029, @tnfchris wrote:

Hmm the last time I upgraded pyyaml it started complaining about the interface we're using being insecure and a security issue. is that no longer the case?

I remember it required slight tweaking.

I didn't get any warning, except for pip complaining about being run as root but that's a separate issue

Hmm ok, It should be giving this warning https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation when LNT starts up.

But if you don't see it they might have did something to not require it.. so LGTM then.

I had only run the tests and launched LNT. I see one of the codepath that uses yaml.load is in lnt admin. I've made an updated patch that update all the calls to load to use safe_load instead and it seems to work.

[thopre]

@tnfchris Are you happy with the new patch?

[tnfchris]

Yes, thanks both!

lnt/lnttool/admin.py

def _set(self, key, value):
         setattr(self, key, value)
 
     @property
     def dict(self):
         return self.__dict__
 
     def _try_load_config(self, filename):
         try:
-            config = yaml.load(open(filename))
+            config = yaml.safe_load(open(filename))
             for key, value in config.items():
                 self._set(key, value)
         except IOError as e:
             if self.verbose or filename != _default_config_filename:
                 _error("Could not load configuration file '%s': %s\n" %
                        (filename, e))
 
     def _check_and_normalize(self):

lnt/server/db/v4db.py

 
 class V4DB(object):
     """
     Wrapper object for LNT v0.4+ databases.
     """
     def _load_schema_file(self, schema_file):
         session = self.make_session(expire_on_commit=False)
         with open(schema_file) as schema_fd:
-            data = yaml.load(schema_fd)
+            data = yaml.safe_load(schema_fd)
         suite = testsuite.TestSuite.from_json(data)
         testsuite.check_testsuite_schema_changes(session, suite)
         suite = testsuite.sync_testsuite_with_metatables(session, suite)
         session.commit()
         session.close()
 
         # Create tables if necessary
         tsdb = lnt.server.db.testsuitedb.TestSuiteDB(self, suite.name, suite)

setup.py

install_requires=[
         "Werkzeug==0.12.2",
         "itsdangerous==0.24",
         "python-gnupg==0.3.7",
         "pytz==2016.10",
         "WTForms==2.0.2",
         "Flask-WTF==0.12",
         "typing",
         "click==6.7",
-        "pyyaml==3.13",
+        "pyyaml==5.1.2",
         "requests",
         "future",
         "lit==0.11.1",
         "certifi"
     ],
 
     ext_modules=[cPerf],
 
     python_requires='>=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*',
 )

tests/server/ui/test_api.py

def test_tests_api(self):
         self.assertEqual('SingleSource/UnitTests/2006-12-01-float_varg', t0['name'])
 
     def test_schema(self):
         client = self.client
         rest_schema = check_json(client, 'api/db_default/v4/nts/schema')
 
         # The reported schema should be the same as the yaml one on the top.
         with open('%s/schemas/nts.yaml' % self.instance_path) as syaml:
-            yaml_schema = yaml.load(syaml)
+            yaml_schema = yaml.safe_load(syaml)
             # Do some massaging to make it similar to the rest API result.
             for m in yaml_schema['metrics']:
                 if 'unit' not in m:
                     m['unit'] = None
                 if 'unit_abbrev' not in m:
                     m['unit_abbrev'] = None
                 if 'display_name' not in m:
                     m['display_name'] = m['name']