avoid deserializing untrusted YAML

문서 > 코드 분석 > Static Analysis Rules > avoid deserializing untrusted YAML

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: python-security/yaml-load

Language: Python

Severity: Warning

Category: Security

Description

Avoid deserialization of untrusted YAML data via potential unsafe yaml.load.

This rule checks that the yaml module is used and the load method is used. It recommends the usage of safe_load that prevents unsafe deserialization.

See Also

CWE-502 - Deserialization of Untrusted Data

Non-Compliant Code Examples

from yaml import load

load("string") # should use safe_load

import yaml

yaml.load("string") # should use safe_load

Compliant Code Examples

import yaml

yaml.load("string", loader=yaml.SafeLoader) # uses SafeLoader, so load is okay

yaml.load("string")