3 ms·
"In contrast, YAML’s foremost design goals are human readability and support for serializing arbitrary native data structures." - YAML Spec: http://yaml.org/sp
by thinkbohemian 14y ago
"In contrast, YAML’s foremost design goals are human readability and support for serializing arbitrary native data structures."
- YAML Spec: http://yaml.org/spec/1.2/spec.html#id2763035 http://yaml.org/spec/1.2/spec.html#id2763035
It isn't an issue with Ruby's implementation, but rather the spec itself.
You're splitting hairs here, and ignoring the rest of the article. YAML isn't evil or a "problem" per say. It's only when you pair YAML with un-sanitized user input that we get into problems.
- tptacek 14y agoWhere here "sanitize" means "disable most of the features of the YAML parser".
- aphexairlines 14y agoThe spec seems safe for data models where instantiating a data structure does not mean running arbitrary code (ie, constructors). For example, ML or Haskell abstract data types, or 'bless' in Perl.
- bradleyland 14y agoI'm not sure what you mean by "data models where instantiating a data structure does not mean running arbitrary code". I can't think of a basic data type (a hard thing to define, btw) in Ruby that doesn't have a constructor, but I'm not sure that's what matters. Any attribute assignment in Ruby can be made dangerous if written in a way that wraps dangerous code in a attribute assignment methods. What I think has gotten Rubyists in trouble is that we forgot YAML really is just serialization. Here's some advice that seems obvious now, but a few weeks ago would have inspired a "wha?" or a "huh?" from a lot of developers. Don't pass anything to YAML::load that you wouldn't pass to Marshal::load. Consider for a moment how someone would react to passing anything from HTTP post to Marshal::load. It seems obvious. It is obvious. YAML is serialization. Whether or not serialization can be made safe is for people much, much smarter than me to figure out.