3 ms·
You cannot call it safer libyaml, when it still allows all unsafe yaml features to happen, creating and destroying objects at will, or calling custom code. A sa
by rurban 3y ago
You cannot call it safer libyaml, when it still allows all unsafe yaml features to happen, creating and destroying objects at will, or calling custom code. A safe yaml, such as my YAML::Safe library, has a white-list of allowed classes, and disables all unsafe features by default.
The safe variant should use libsyck btw, which didn't implement all the new unsafe yaml features.
- 01HNNWZ0MV43FF 3y agoMemory unsafe or logically unsafe?
- rurban 3y agoBoth. Logical unsafety leading to memory unsafety, leading to exploits. A very popular blogging platform had to closed because of this.
- pornel 3y agoRust uses "unsafe"/"safe Rust" as its jargon term that has a specific narrow definition in Rust's context.