avoid deserializing untrusted YAML
This product is not supported for your selected
Datadog site. (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.ID: python-security/yaml-load
Language: Python
Severity: Warning
Category: Security
CWE: 502
Description
Avoid deserialization of untrusted YAML data via potential unsafe yaml.load.
This rule checks that the yaml module is used and the load method is used. It recommends the usage of safe_load that prevents unsafe deserialization.
See Also
Non-Compliant Code Examples
from yaml import load
load("string") # should use safe_load
import yaml
yaml.load("string") # should use safe_load
Compliant Code Examples
import yaml
yaml.load("string", Loader=yaml.SafeLoader) # uses SafeLoader, so load is okay
원활한 통합. Datadog Code Security를 경험해 보세요
