4 ms·

You know that JSON is subset of yaml, right?

dragonwriter 3y ago
Since most people’s (especially critics) understanding of YAML is stuck on YAML 1.1 where that wasn't quite true, probably not.
arwineap 3y ago
The commenter said they preferred json over yaml because yaml is whitespace sensitive; Json is not yaml's feature set is also too broad, forcing safe loaders
- bshacklett 3y ago
  I think the point is that if something accepts YAML, you can feed it JSON without issue. > yaml's feature set is also too broad, forcing safe loaders Could you elaborate?
  - arwineap 3y ago
    Yaml tags allow for serialization of native types, and has been abused to run malicious code. I think you can also make circular references in yaml effectively making a zip bomb This is why you have yaml.safe_load in Python and SafeConstructor in Java's snakeyaml package The end result is that you should not use yaml to handle untrusted data unless you are also explicitly handling it safely
    - bshacklett 3y ago
      Any de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.
      - arwineap 3y ago
        The json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this
        bshacklett 3y ago
        I feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON: https://owasp.org/search/?searchString=json https://owasp.org/search/?searchString=json Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?

Since most people’s (especially critics) understanding of YAML is stuck on YAML 1.1 where that wasn't quite true, probably not.

arwineap 3y ago

The commenter said they preferred json over yaml because yaml is whitespace sensitive; Json is not yaml's feature set is also too broad, forcing safe loaders

bshacklett 3y ago
I think the point is that if something accepts YAML, you can feed it JSON without issue. > yaml's feature set is also too broad, forcing safe loaders Could you elaborate?
- arwineap 3y ago
  Yaml tags allow for serialization of native types, and has been abused to run malicious code. I think you can also make circular references in yaml effectively making a zip bomb This is why you have yaml.safe_load in Python and SafeConstructor in Java's snakeyaml package The end result is that you should not use yaml to handle untrusted data unless you are also explicitly handling it safely
  - bshacklett 3y ago
    Any de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.
    - arwineap 3y ago
      The json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this
      - bshacklett 3y ago
        I feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON: https://owasp.org/search/?searchString=json https://owasp.org/search/?searchString=json Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?