3 ms·
So you get insecure YAML, in contrast to YAML 1.1. Don't use YAML 1.2, use the secure subset 1.1. Or even better StrictYAML
by rurban 4y ago
So you get insecure YAML, in contrast to YAML 1.1.
Don't use YAML 1.2, use the secure subset 1.1. Or even better StrictYAML
- Dylan16807 4y agoThe secure subset? I mean, things like "NO" were fixed later.
- rurban 4y agoYes, but objects, refs, tags came all in 1.2. StrictYAML got rid of all these, as all the safer YAML variants. E.g. perl5 still uses 1.0 for its cpan metadata abstraction, and still has to restrict these. I maintain the https://metacpan.org/pod/YAML::Safe https://metacpan.org/pod/YAML::Safe module, which allows whitelisting of certain objects.