Use safeLoad for untrusted yaml

lib/context.js

@@ -72,7 +72,7 @@ class Context {
   async config(fileName) {
     const params = this.repo({path: path.join('.github', fileName)});
     const data = await this.github.repos.getContent(params);
-    return yaml.load(Buffer.from(data.content, 'base64').toString()) || {};
+    return yaml.safeLoad(Buffer.from(data.content, 'base64').toString()) || {};
   }
 }
 

test/context.js

@@ -137,6 +137,22 @@ describe('Context', function () {
       expect(e.message).toMatch(/^end of the stream or a document separator/);
     });
 
+    it('throws when loading unsafe yaml', async function () {
+      github.repos.getContent.andReturn(readConfig('evil.yml'));
+
+      let e;
+      let config;
+      try {
+        config = await context.config('evil.yml');
+      } catch (err) {
+        e = err;
+      }
+
+      expect(config).toNotExist();
+      expect(e).toExist();
+      expect(e.message).toMatch(/unknown tag/);
+    });
+
     it('returns an empty object when the file is empty', async function () {
       github.repos.getContent.andReturn(readConfig('empty.yml'));