4 ms·
Python's YAML libraries come with a safe_load function that disables !! commands, so it can be used without loading arbitrary objects.
by philipov 8y ago
Python's YAML libraries come with a safe_load function that disables !! commands, so it can be used without loading arbitrary objects.
- ArneBab 8y agoAnd they warn quite clearly about that. Though in hindsight, having load and unsafe_load would have been safer.
- jwilk 8y ago> And they warn quite clearly about that. Do they? https://github.com/yaml/pyyaml https://github.com/yaml/pyyaml doesn't even mention safe_load(). And this is the docstring for yaml.load(): Parse the first YAML document in a stream and produce the corresponding Python object. This doesn't sound very scary, and certainly doesn't imply possible code execution.