mirror of
https://github.com/yaml/pyyaml.git
synced 2025-10-19 11:03:18 +00:00
0cedb2a069
The `load` and `load_all` methods will issue a warning when they are
called without the 'Loader=' parameter. The warning will point to a URL
that is always up to date with the latest information on the usage of
`load`.
There are several ways to stop the warning:
* Use `full_load(input)` - sugar for `yaml.load(input, FullLoader)`
* FullLoader is the new safe but complete loader class
* Use `safe_load(input)` - sugar for `yaml.load(input, SafeLoader)`
* Make sure your input YAML consists of the 'safe' subset
* Use `unsafe_load(input)` - sugar for `yaml.load(input, UnsafeLoader)`
* Make sure your input YAML consists of the 'safe' subset
* Use `yaml.load(input, Loader=yaml.<loader>)`
* Or shorter `yaml.load(input, yaml.<loader>)`
* Where '<loader>' can be:
* FullLoader - safe, complete Python YAML loading
* SafeLoader - safe, partial Python YAML loading
* UnsafeLoader - more explicit name for the old, unsafe 'Loader' class
* yaml.warnings({'YAMLLoadWarning': False})
* Use this when you use third party modules that use `yaml.load(input)`
* Only do this if input is trusted
The above `load()` expressions all have `load_all()` counterparts.
You can get the original unsafe behavior with:
* `yaml.unsafe_load(input)`
* `yaml.load(input, Loader=yaml.UnsafeLoader)`
In a future release, `yaml.load(input)` will raise an exception.
The new loader called FullLoader is almost entirely complete as
Loader/UnsafeLoader but it does it avoids all known code execution
paths. It is the preferred YAML loader, and the current default for
`yaml.load(input)` when you get the warning.
Here are some of the exploits that can be triggered with UnsafeLoader
but not with FullLoader:
```
python -c 'import os, yaml; yaml.full_load("!!python/object/new:os.system [echo EXPLOIT!]")'`
python -c 'import yaml; print yaml.full_load("!!python/object/new:abs [-5]")'
python -c 'import yaml; yaml.full_load("!!python/object/new:eval [exit(5)]")' ; echo $?
python -c 'import yaml; yaml.full_load("!!python/object/new:exit [5]")' ; echo $?
101 lines
3.6 KiB
Python
101 lines
3.6 KiB
Python
|
|
__all__ = [
|
|
'CBaseLoader', 'CSafeLoader', 'CFullLoader', 'CUnsafeLoader', 'CLoader',
|
|
'CBaseDumper', 'CSafeDumper', 'CDumper'
|
|
]
|
|
|
|
from _yaml import CParser, CEmitter
|
|
|
|
from constructor import *
|
|
|
|
from serializer import *
|
|
from representer import *
|
|
|
|
from resolver import *
|
|
|
|
class CBaseLoader(CParser, BaseConstructor, BaseResolver):
|
|
|
|
def __init__(self, stream):
|
|
CParser.__init__(self, stream)
|
|
BaseConstructor.__init__(self)
|
|
BaseResolver.__init__(self)
|
|
|
|
class CSafeLoader(CParser, SafeConstructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
CParser.__init__(self, stream)
|
|
SafeConstructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
class CFullLoader(CParser, FullConstructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
CParser.__init__(self, stream)
|
|
FullConstructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
class CUnsafeLoader(CParser, UnsafeConstructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
CParser.__init__(self, stream)
|
|
UnsafeConstructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
class CLoader(CParser, Constructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
CParser.__init__(self, stream)
|
|
Constructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
class CBaseDumper(CEmitter, BaseRepresenter, BaseResolver):
|
|
|
|
def __init__(self, stream,
|
|
default_style=None, default_flow_style=None,
|
|
canonical=None, indent=None, width=None,
|
|
allow_unicode=None, line_break=None,
|
|
encoding=None, explicit_start=None, explicit_end=None,
|
|
version=None, tags=None):
|
|
CEmitter.__init__(self, stream, canonical=canonical,
|
|
indent=indent, width=width, encoding=encoding,
|
|
allow_unicode=allow_unicode, line_break=line_break,
|
|
explicit_start=explicit_start, explicit_end=explicit_end,
|
|
version=version, tags=tags)
|
|
Representer.__init__(self, default_style=default_style,
|
|
default_flow_style=default_flow_style)
|
|
Resolver.__init__(self)
|
|
|
|
class CSafeDumper(CEmitter, SafeRepresenter, Resolver):
|
|
|
|
def __init__(self, stream,
|
|
default_style=None, default_flow_style=None,
|
|
canonical=None, indent=None, width=None,
|
|
allow_unicode=None, line_break=None,
|
|
encoding=None, explicit_start=None, explicit_end=None,
|
|
version=None, tags=None):
|
|
CEmitter.__init__(self, stream, canonical=canonical,
|
|
indent=indent, width=width, encoding=encoding,
|
|
allow_unicode=allow_unicode, line_break=line_break,
|
|
explicit_start=explicit_start, explicit_end=explicit_end,
|
|
version=version, tags=tags)
|
|
SafeRepresenter.__init__(self, default_style=default_style,
|
|
default_flow_style=default_flow_style)
|
|
Resolver.__init__(self)
|
|
|
|
class CDumper(CEmitter, Serializer, Representer, Resolver):
|
|
|
|
def __init__(self, stream,
|
|
default_style=None, default_flow_style=None,
|
|
canonical=None, indent=None, width=None,
|
|
allow_unicode=None, line_break=None,
|
|
encoding=None, explicit_start=None, explicit_end=None,
|
|
version=None, tags=None):
|
|
CEmitter.__init__(self, stream, canonical=canonical,
|
|
indent=indent, width=width, encoding=encoding,
|
|
allow_unicode=allow_unicode, line_break=line_break,
|
|
explicit_start=explicit_start, explicit_end=explicit_end,
|
|
version=version, tags=tags)
|
|
Representer.__init__(self, default_style=default_style,
|
|
default_flow_style=default_flow_style)
|
|
Resolver.__init__(self)
|
|
|