mirror of
https://github.com/yaml/pyyaml.git
synced 2025-10-19 19:13:19 +00:00

The `load` and `load_all` methods will issue a warning when they are called without the 'Loader=' parameter. The warning will point to a URL that is always up to date with the latest information on the usage of `load`. There are several ways to stop the warning: * Use `full_load(input)` - sugar for `yaml.load(input, FullLoader)` * FullLoader is the new safe but complete loader class * Use `safe_load(input)` - sugar for `yaml.load(input, SafeLoader)` * Make sure your input YAML consists of the 'safe' subset * Use `unsafe_load(input)` - sugar for `yaml.load(input, UnsafeLoader)` * Make sure your input YAML consists of the 'safe' subset * Use `yaml.load(input, Loader=yaml.<loader>)` * Or shorter `yaml.load(input, yaml.<loader>)` * Where '<loader>' can be: * FullLoader - safe, complete Python YAML loading * SafeLoader - safe, partial Python YAML loading * UnsafeLoader - more explicit name for the old, unsafe 'Loader' class * yaml.warnings({'YAMLLoadWarning': False}) * Use this when you use third party modules that use `yaml.load(input)` * Only do this if input is trusted The above `load()` expressions all have `load_all()` counterparts. You can get the original unsafe behavior with: * `yaml.unsafe_load(input)` * `yaml.load(input, Loader=yaml.UnsafeLoader)` In a future release, `yaml.load(input)` will raise an exception. The new loader called FullLoader is almost entirely complete as Loader/UnsafeLoader but it does it avoids all known code execution paths. It is the preferred YAML loader, and the current default for `yaml.load(input)` when you get the warning. Here are some of the exploits that can be triggered with UnsafeLoader but not with FullLoader: ``` python -c 'import os, yaml; yaml.full_load("!!python/object/new:os.system [echo EXPLOIT!]")'` python -c 'import yaml; print yaml.full_load("!!python/object/new:abs [-5]")' python -c 'import yaml; yaml.full_load("!!python/object/new:eval [exit(5)]")' ; echo $? python -c 'import yaml; yaml.full_load("!!python/object/new:exit [5]")' ; echo $?
63 lines
2 KiB
Python
63 lines
2 KiB
Python
|
|
__all__ = ['BaseLoader', 'FullLoader', 'SafeLoader', 'Loader', 'UnsafeLoader']
|
|
|
|
from reader import *
|
|
from scanner import *
|
|
from parser import *
|
|
from composer import *
|
|
from constructor import *
|
|
from resolver import *
|
|
|
|
class BaseLoader(Reader, Scanner, Parser, Composer, BaseConstructor, BaseResolver):
|
|
|
|
def __init__(self, stream):
|
|
Reader.__init__(self, stream)
|
|
Scanner.__init__(self)
|
|
Parser.__init__(self)
|
|
Composer.__init__(self)
|
|
BaseConstructor.__init__(self)
|
|
BaseResolver.__init__(self)
|
|
|
|
class FullLoader(Reader, Scanner, Parser, Composer, FullConstructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
Reader.__init__(self, stream)
|
|
Scanner.__init__(self)
|
|
Parser.__init__(self)
|
|
Composer.__init__(self)
|
|
FullConstructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
class SafeLoader(Reader, Scanner, Parser, Composer, SafeConstructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
Reader.__init__(self, stream)
|
|
Scanner.__init__(self)
|
|
Parser.__init__(self)
|
|
Composer.__init__(self)
|
|
SafeConstructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
class Loader(Reader, Scanner, Parser, Composer, Constructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
Reader.__init__(self, stream)
|
|
Scanner.__init__(self)
|
|
Parser.__init__(self)
|
|
Composer.__init__(self)
|
|
Constructor.__init__(self)
|
|
Resolver.__init__(self)
|
|
|
|
# UnsafeLoader is the same as Loader (which is and was always unsafe on
|
|
# untrusted input). Use of either Loader or UnsafeLoader should be rare, since
|
|
# FullLoad should be able to load almost all YAML safely. Loader is left intact
|
|
# to ensure backwards compatability.
|
|
class UnsafeLoader(Reader, Scanner, Parser, Composer, Constructor, Resolver):
|
|
|
|
def __init__(self, stream):
|
|
Reader.__init__(self, stream)
|
|
Scanner.__init__(self)
|
|
Parser.__init__(self)
|
|
Composer.__init__(self)
|
|
Constructor.__init__(self)
|
|
Resolver.__init__(self)
|