4 ms·
YAML allows deserialization into arbitrary native types, which most definitely is [1] an issue (see: the flood of Rails/YAML vulns a while back) [1] http://blo
by jffry 12y ago
YAML allows deserialization into arbitrary native types, which most definitely is [1] an issue (see: the flood of Rails/YAML vulns a while back)
[1] http://blogs.teamb.com/craigstuntz/2013/02/04/38738/ http://blogs.teamb.com/craigstuntz/2013/02/04/38738/
- crdoconnor 12y agoThat is an issue, but it's more of an education/naming issue since it is, after all, intentional. I think it's really dumb that most YAML libraries have a load() and a safe_load(). If they had a load() and a dangerous_load() then the problem basically wouldn't exist.