3 ms·
Wait, what? It's built in to the format that it can execute arbitrary shell commands? "Who approved this?!" I can't imagine the cluster fuck of ideas in a per
by moron4hire 7y ago
Wait, what? It's built in to the format that it can execute arbitrary shell commands?
"Who approved this?!"
I can't imagine the cluster fuck of ideas in a person's head to lead to thinking that this was an ok design for a configuration file. The person who designed this and I just don't live on the same planet.
And here I thought the reason I didn't use YAML was because the syntax looked stupid.
- ezrast 7y agoNo, it's built into the format that implementations can extend it with their own types. Then library authors decided it would be neat if any object in their language could be serialized as yaml, and so extended it with types that happen to be able to execute arbitrary code, because that's what objects do in dynamic languages. A more conservative implementation wouldn't have that particular vulnerability.