avoid deserializing untrusted YAML
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
ID: python-security/yaml-load
Language: Python
Severity: Warning
Category: Security
CWE: 502
Description
Avoid deserialization of untrusted YAML data via potential unsafe yaml.load.
This rule checks that the yaml module is used and the load method is used. It recommends the usage of safe_load that prevents unsafe deserialization.
See Also
Non-Compliant Code Examples
from yaml import load
load("string") # should use safe_load
import yaml
yaml.load("string") # should use safe_load
Compliant Code Examples
import yaml
yaml.load("string", loader=yaml.SafeLoader) # uses SafeLoader, so load is okay
Seamless integrations. Try Datadog Code Analysis
