YAML uses UnsafeLoader
yaml.load() in cdb_signal_spammer.py and in signal_gatherer.py currently uses UnsafeLoader in order to allow loading of arbitrary python functions. This can be dangerous as it allows running arbitrary python code. We should implement a custom loader that can load only verified functions. E.g. only those that are from certain repos in our gitlab (is it doable?).
Edited by Jakub Seidl