3 ms·
Sure, but most language YAML parsers support all or most of the spec. That can be a problem if you aren't expecting it.
by __david__ 11y ago
Sure, but most language YAML parsers support all or most of the spec. That can be a problem if you aren't expecting it.
- alanh 11y agoI believe it has even created security issues. Didn’t Rails have at least one YAML-based vuln?
- rurban 11y agoYou need to restrict YAML to SecureLoad, with manually adding allowed typed and classes. At least perl doesn't support this, so it's inherently insecure there, but you can always use YAML::Syck which didn't go this way.