safe load puppet data files

Author: mschuchard

CHANGELOG.md

@@ -6,6 +6,7 @@
 - Add `rubocop-rspec` plugin to Ruby checks.
 - Fix `--fail-on-warnings` functionality.
 - Improve safety of Ruby syntax checks.
+- Safely load Puppet data files.
 
 ### 2.3.1
 - No input target paths now defaults to current working directory instead of error.

lib/puppet-check/data_parser.rb

@@ -8,7 +8,7 @@ class DataParser
   def self.yaml(files)
     files.each do |file|
       # check yaml syntax
-      parsed = YAML.load_file(file)
+      parsed = YAML.safe_load_file(file, permitted_classes: [Symbol], permitted_symbols: [], aliases: true)
     rescue StandardError => err
       PuppetCheck.files[:errors][file] = err.to_s.gsub("(#{file}): ", '').split("\n")
     else
@@ -44,7 +44,7 @@ def self.eyaml(files, public, private)
 
     files.each do |file|
       # check encoded yaml syntax
-      parsed = YAML.load_file(file)
+      parsed = YAML.safe_load_file(file, permitted_classes: [Symbol], permitted_symbols: [], aliases: true)
 
       # extract encoded values
       # ENC[PKCS7]