Merge branch 'sh-use-yaml-safe-load' into 'master'

Use YAML.safe_load_file for import/export config

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117027



Merged-by: George Koltsov <gkoltsov@gitlab.com>
Approved-by: Joseph Wambua <jjoshua@gitlab.com>
Approved-by: George Koltsov <gkoltsov@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

lib/gitlab/import_export/config.rb

@@ -52,7 +52,7 @@ def merge_ee?
       end
 
       def parse_yaml
-        YAML.load_file(@config)
+        YAML.safe_load_file(@config, aliases: true, permitted_classes: [Symbol])
       end
     end
   end

spec/lib/gitlab/import_export/attributes_finder_spec.rb

@@ -177,7 +177,8 @@
       end
 
       def setup_yaml(hash)
-        allow(YAML).to receive(:load_file).with(test_config).and_return(hash)
+        allow(YAML).to receive(:safe_load_file)
+          .with(test_config, aliases: true, permitted_classes: [Symbol]).and_return(hash)
       end
     end
   end

spec/lib/gitlab/import_export/model_configuration_spec.rb

@@ -9,7 +9,7 @@
   include ConfigurationHelper
 
   let(:all_models_yml) { 'spec/lib/gitlab/import_export/all_models.yml' }
-  let(:all_models_hash) { YAML.load_file(all_models_yml) }
+  let(:all_models_hash) { YAML.safe_load_file(all_models_yml, aliases: true) }
   let(:current_models) { setup_models }
   let(:model_names) { relation_names_for(:project) }