4 ms·

> This is desired functionality by the creators of YAML, since it gives developers the ability to write and read Ruby objects to disk, like an object database.

• thinkbohemian 14y ago
  "In contrast, YAML’s foremost design goals are human readability and support for serializing arbitrary native data structures." - YAML Spec: http://yaml.org/spec/1.2/spec.html#id2763035 http://yaml.org/spec/1.2/spec.html#id2763035 It isn't an issue with Ruby's implementation, but rather the spec itself. You're splitting hairs here, and ignoring the rest of the article. YAML isn't evil or a "problem" per say. It's only when you pair YAML with un-sanitized user input that we get into problems.
  • tptacek 14y ago
    Where here "sanitize" means "disable most of the features of the YAML parser".
  • aphexairlines 14y ago
    The spec seems safe for data models where instantiating a data structure does not mean running arbitrary code (ie, constructors). For example, ML or Haskell abstract data types, or 'bless' in Perl.
    • bradleyland 14y ago
      I'm not sure what you mean by "data models where instantiating a data structure does not mean running arbitrary code". I can't think of a basic data type (a hard thing to define, btw) in Ruby that doesn't have a constructor, but I'm not sure that's what matters. Any attribute assignment in Ruby can be made dangerous if written in a way that wraps dangerous code in a attribute assignment methods. What I think has gotten Rubyists in trouble is that we forgot YAML really is just serialization. Here's some advice that seems obvious now, but a few weeks ago would have inspired a "wha?" or a "huh?" from a lot of developers. Don't pass anything to YAML::load that you wouldn't pass to Marshal::load. Consider for a moment how someone would react to passing anything from HTTP post to Marshal::load. It seems obvious. It is obvious. YAML is serialization. Whether or not serialization can be made safe is for people much, much smarter than me to figure out.