Use yaml safely

project.clj

@@ -67,7 +67,7 @@
                  [honeysql "0.8.2"]                                   ; Transform Clojure data structures to SQL
                  [io.crate/crate-jdbc "2.1.6"]                        ; Crate JDBC driver
                  [instaparse "1.4.0"]                                 ; Insaparse parser generator
-                 [io.forward/yaml "1.0.6"                             ; Clojure wrapper for YAML library SnakeYAML (which we already use for liquidbase)
+                 [io.forward/yaml "1.0.7"                             ; Clojure wrapper for YAML library SnakeYAML (which we already use for liquidbase)
                   :exclusions [org.clojure/clojure
                                org.yaml/snakeyaml]]
                  [kixi/stats "0.3.10"                                 ; Various statistic measures implemented as transducers

src/metabase/automagic_dashboards/rules.clj

@@ -9,7 +9,8 @@
             [schema
              [coerce :as sc]
              [core :as s]]
-            [yaml.core :as yaml]))
+            [yaml.core :as yaml])
+  (:import org.yaml.snakeyaml.constructor.SafeConstructor))
 
 (def ^Long ^:const max-score
   "Maximal (and default) value for heuristics scores."
@@ -233,7 +234,7 @@
     (try
       (-> f
           slurp
-          yaml/parse-string
+          (yaml/parse-string :constructor (SafeConstructor.))
           (assoc :rule (file-name->table-type f))
           (update :table_type #(or % (file-name->table-type f)))
           rules-validator)