Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use SafeYAML.load to avoid YAML monkeypatch in safe_yaml. #303

Merged
merged 1 commit into from
Dec 24, 2013
Merged

Use SafeYAML.load to avoid YAML monkeypatch in safe_yaml. #303

merged 1 commit into from
Dec 24, 2013

Conversation

fnichol
Copy link
Contributor

@fnichol fnichol commented Dec 23, 2013

This will leave YAML loading in Test Kitchen as implementation detail
and avoid polluting other Ruby objects.

This will leave YAML loading in Test Kitchen as implementation detail
and avoid polluting other Ruby objects.
@damm
Copy link

damm commented Dec 24, 2013

Just keep in mind eventually we will get past the limits of sanity and need to creating more ground.

People seem to be giving YAML a bad rap over these exploits. The truth is that all of these exploits exist in any scheme that allows you to create arbitrary objects in a target system. This is why nobody uses Marshal to send objects around. Think of YAML as a human readable Marshal.

YAML f7u12

fnichol added a commit that referenced this pull request Dec 24, 2013
Use SafeYAML.load to avoid YAML monkeypatch in safe_yaml.
@fnichol fnichol merged commit eb7743e into test-kitchen:master Dec 24, 2013
@fnichol fnichol deleted the safe-yaml-lib branch December 24, 2013 23:27
@test-kitchen test-kitchen locked and limited conversation to collaborators Nov 16, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants