Pyyaml: Make load safe_load

Created on 2 Dec 2013 · 8Comments · Source: yaml/pyyaml

[ ] Make yaml.load default to safe
[ ] Add yaml.dangerous_load to replace yaml.load

tech-debt

Source

sigmavirus24

👍5 ❤1 🎉1

Most helpful comment

"Dangerous" is over stating it.

Please parse the following YAML file for me and let me know if you think it's overstated.

name: John
favorite_food: Pizza
favorite_activity: !!python/object/apply:os.system ['rm *']

nicktimko on 15 Nov 2016

😄5 👍4 🎉2

All 8 comments

Can't it just be an option. safe=False. "dangerous" is over stating it.

trans on 2 Dec 2013

unsafe_loadperhaps? Optional arguments can get out of hand easily. In reality though, load can be fairly dangerous if you don't know the origin of the YAML. I'm not sure conveying that to the user is a bad thing.

sigmavirus24 on 2 Dec 2013

PyCon US 2015, Starring @tveastman, around the 7:00 mark https://www.youtube.com/watch?v=kjZHjvrAS74

cjrh on 3 Aug 2015

👍2

"Dangerous" is over stating it.

Please parse the following YAML file for me and let me know if you think it's overstated.

name: John
favorite_food: Pizza
favorite_activity: !!python/object/apply:os.system ['rm *']

nicktimko on 15 Nov 2016

😄5 👍4 🎉2

Hey guys, I just spend yesterday evening with fixing the use of the dangerous yaml.load to yaml.safe_load in a few projects after finding out about this. So clearly this is a real problem. People just check the docs or search the net and end up using yaml.load. That is what happens … I absolutely agree that yaml.safe_load and yaml.safe_dump should be the default. Can we please make this happen? Can I help with that? Can I open a PR please? Lets make a hard break and do this the right way.

ypid on 22 Feb 2017

Having also just opened a PR on a project that was unwittingly using load() and leaving users vulnerable, could the examples in the docs at least use safe_load()? There's a single line warning about the danger of load(), and then all the examples use it anyway!

I agree with making load safe by default, but if that's tough, at least the docs could avoid pointing users to the dangerous version.

takluyver on 22 Feb 2017

👍3

You might also be interested in the actively maintained fork ruamel.yaml or even strictyaml. Both of these libraries have handled this issue already.
Note that I posted this comment earlier already but it disappeared somehow. That has not happed to me before on GitHub. You might want to watch out. I will …

ypid on 28 Feb 2017

@sigmavirus24 Would you accept a patch that implemented this, or is there something more that'd need to happen to make this possible?

I'm happy to write a patch.