Do not use insecure YAML deserialization

Docs > Code Analysis > Static Analysis Rules > Do not use insecure YAML deserialization

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: python-security/ruamel-unsafe-yaml

Language: Python

Severity: Error

Category: Security

CWE: 502

Description

Unsafe YAML deserialization. Make sure to use safe deserialization methods to avoid execution or arbitrary code.

Learn More

ruamel.yaml documentation
CWE 502 - Deserialization of Untrusted Data

Non-Compliant Code Examples

from ruamel.yaml import YAML

foo = YAML(typ='unsafe')

def myfunction(arg):
    bar = YAML(typ='base')

Compliant Code Examples

foo = YAML(typ='unsafe')

def myfunction(arg):
    bar = YAML(typ='base')

from ruamel.yaml import YAML

default = YAML()

rt = YAML(typ='rt')

safe = YAML(typ='safe')