6 ms·
Python's YAML library is also capable of serializing python objects[1]. My understanding is the YAML spec allows these extensions but does not require them. If
by SoftwareMaven 14y ago
Python's YAML library is also capable of serializing python objects[1]. My understanding is the YAML spec allows these extensions but does not require them.
If you are using PyYaml.Loader instead of PyYaml.SafeLoader for anything coming from a user, you are at risk of this problem.
http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPythontypes http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPython...