---
title: Prevent using YAML functions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Prevent using YAML functions
---

# Prevent using YAML functions

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site). ().
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `ruby-security/yaml-load`

**Language:** Ruby

**Severity:** Warning

**Category:** Security

**CWE**: [502](https://cwe.mitre.org/data/definitions/502.html)

## Description{% #description %}

This rule is designed to prevent the use of YAML functions in Ruby code. YAML functions such as `YAML.load` and `YAML.load_file` can be potentially dangerous as they have the ability to deserialize arbitrary objects, which can lead to code execution vulnerabilities if the input is not trusted.

Adhering to this rule is important to ensure the security of the application. When untrusted data is deserialized, it can lead to a variety of security exploits, including Remote Code Execution (RCE), which can provide an attacker with complete control over the application.

To avoid this, use safer methods such as `Psych.safe_load` or `YAML.safe_load` instead. These methods only allow the deserialization of simple, safe types. Additionally, always ensure that the data being deserialized is from a trusted source. By following these good coding practices, you can maintain the security and integrity of your Ruby application.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```ruby
YAML.load(data)
YAML.load_file(filename)
```

## Compliant Code Examples{% #compliant-code-examples %}

```ruby
Psych.safe_load('--- foo')
YAML.load("something")
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}