Do not use insecure YAML deserialization

Docs > Code Analysis > Static Analysis Rules > Do not use insecure YAML deserialization

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: python-security/ruamel-unsafe-yaml

Language: Python

Severity: Error

Category: Security

Description

Unsafe YAML deserialization. Make sure to use safe deserialization methods to avoid execution or arbitrary code.

Learn More

ruamel.yaml documentation
CWE 502 - Deserialization of Untrusted Data

Non-Compliant Code Examples

from ruamel.yaml import YAML

foo = YAML(typ='unsafe')

def myfunction(arg):
    bar = YAML(typ='base')

Compliant Code Examples

foo = YAML(typ='unsafe')

def myfunction(arg):
    bar = YAML(typ='base')

from ruamel.yaml import YAML

default = YAML()

rt = YAML(typ='rt')

safe = YAML(typ='safe')