3 ms·
I think the point is that if something accepts YAML, you can feed it JSON without issue. > yaml's feature set is also too broad, forcing safe loaders Could yo
by bshacklett 3y ago
I think the point is that if something accepts YAML, you can feed it JSON without issue.
> yaml's feature set is also too broad, forcing safe loaders
Could you elaborate?
- arwineap 3y agoYaml tags allow for serialization of native types, and has been abused to run malicious code. I think you can also make circular references in yaml effectively making a zip bomb This is why you have yaml.safe_load in Python and SafeConstructor in Java's snakeyaml package The end result is that you should not use yaml to handle untrusted data unless you are also explicitly handling it safely
- bshacklett 3y agoAny de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.
- arwineap 3y agoThe json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this
- bshacklett 3y agoI feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON: https://owasp.org/search/?searchString=json https://owasp.org/search/?searchString=json Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?