Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> As Stormbrew already pointed out, we already have a format that is ideal for configurations (and sure, data exchange, why not), and it is called yaml.

Unfortunately YAML for untrusted input and data exchange is unsafe by default, depending on the language and implementation. A flag might need to be set, or extra modules included like SafeYAML[1] to keep Yaml from instantiating arbitrary objects.

[1] https://github.com/dtao/safe_yaml



I thought the problem wasn't with yaml but with allowing deserialize arbitrary objects which is unsafe by default for a format used both for 'trusted' and 'untrusted' input, If you have a json library which tries to allow deserializing arbitrary objects by default (with a load rather then unsafe_load method). Python's pickle serialization is unsafe but it warns you that its unsafe and is not widely used leading to it not being used as a serialization format for for unsafe input.


>The problem with YAML is it's not safe by default

Why would that be an issue when using it as a configuration format?


Because the parsers for that configuration format are unsafe too? Duh!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: