X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/8ed521f7fd1e48e1e415125745ed8c6627a62c91..4a1735427d84743f6c2f3576263fdcae397cf9e9:/services/api/app/models/workflow.rb

diff --git a/services/api/app/models/workflow.rb b/services/api/app/models/workflow.rb
index 54fcf9b9ab..0268c4e979 100644
--- a/services/api/app/models/workflow.rb
+++ b/services/api/app/models/workflow.rb
@@ -1,3 +1,7 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 class Workflow < ArvadosModel
   include HasUuid
   include KindAndEtag
@@ -14,7 +18,7 @@ class Workflow < ArvadosModel
 
   def validate_definition
     begin
-      @definition_yaml = YAML.load self.definition if !definition.nil?
+      @definition_yaml = YAML.safe_load self.definition if !definition.nil?
     rescue => e
       errors.add :definition, "is not valid yaml: #{e.message}"
     end
@@ -23,7 +27,7 @@ class Workflow < ArvadosModel
   def set_name_and_description
     old_wf = {}
     begin
-      old_wf = YAML.load self.definition_was if !self.definition_was.nil?
+      old_wf = YAML.safe_load self.definition_was if !self.definition_was.nil?
     rescue => e
       logger.warn "set_name_and_description error: #{e.message}"
       return
@@ -43,4 +47,8 @@ class Workflow < ArvadosModel
   def self.full_text_searchable_columns
     super - ["definition"]
   end
+
+  def self.limit_index_columns_read
+    ["definition"]
+  end
 end