YAML is a human-readable text serialization format commonly used for configuration and data exchange. The security question is whether an application accepts YAML from an untrusted source: serialized input can influence server behavior, and unsafe deserialization can enable code execution. section 11.1
Treat YAML parsing as a security boundary. Prefer a safe loader when the YAML library provides one, and avoid assuming that a readable text format is automatically safe. When serialized state must cross an untrusted boundary, consider integrity protection such as a digital signature. section 11.1 section 11.16
Safe YAML round trip
A Python application can serialize a small mapping with yaml.dump and deserialize it with yaml.load using yaml.SafeLoader. The loader choice is the important defensive detail when handling serialized input. section 11.1
import yaml
data = {
"name" : "Rammellzee",
"address" : "Far Rockaway, Queens"
}
serialized_data = yaml.dump(data)
deserialized_data = yaml.load(serialized_data,
Loader=yaml.SafeLoader)
Inspect a compact Python example that dumps a mapping to YAML and loads it through SafeLoader. section 11.1
Apply these precautions when YAML or another serialized format crosses an application boundary:
- Reject or constrain serialized content from untrusted sources whenever possible. section 11.16
- Prefer text formats such as YAML or JSON when suitable, while still treating input as potentially hostile. section 11.16
- Use signatures when serialized state must be protected against tampering. section 11.16
