Skip to content

Commit

Permalink
Make pyyaml safe by default.
Browse files Browse the repository at this point in the history
Change yaml.load/yaml.dump to be yaml.safe_load/yaml.safe_dump, introduced yaml.danger_dump/yaml.danger_load, and the same for various other classes.

(python2 only at this moment)

Refs #5
  • Loading branch information
alex authored and sigmavirus24 committed Aug 26, 2017
1 parent d856c20 commit 7b68405
Show file tree
Hide file tree
Showing 6 changed files with 46 additions and 38 deletions.
41 changes: 25 additions & 16 deletions lib/yaml/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -65,40 +65,48 @@ def load(stream, Loader=Loader):
"""
Parse the first YAML document in a stream
and produce the corresponding Python object.
By default resolve only basic YAML tags, if an alternate Loader is
provided, may be dangerous.
"""
loader = Loader(stream)
try:
return loader.get_single_data()
finally:
loader.dispose()
safe_load = load

def load_all(stream, Loader=Loader):
"""
Parse all YAML documents in a stream
and produce corresponding Python objects.
By default resolve only basic YAML tags, if an alternate Loader is
provided, may be dangerous.
"""
loader = Loader(stream)
try:
while loader.check_data():
yield loader.get_data()
finally:
loader.dispose()
safe_load_all = load_all

def safe_load(stream):
def danger_load(stream):
"""
Parse the first YAML document in a stream
and produce the corresponding Python object.
Resolve only basic YAML tags.
When used on untrusted input, can result in arbitrary code execution.
"""
return load(stream, SafeLoader)
return load(stream, DangerLoader)

def safe_load_all(stream):
def danger_load_all(stream):
"""
Parse all YAML documents in a stream
and produce corresponding Python objects.
Resolve only basic YAML tags.
When used on untrusted input, can result in arbitrary code execution.
"""
return load_all(stream, SafeLoader)
return load_all(stream, DangerLoader)

def emit(events, stream=None, Dumper=Dumper,
canonical=None, indent=None, width=None,
Expand Down Expand Up @@ -193,29 +201,31 @@ def dump_all(documents, stream=None, Dumper=Dumper,
dumper.dispose()
if getvalue:
return getvalue()
safe_dump_all = dump_all

def dump(data, stream=None, Dumper=Dumper, **kwds):
def danger_dump_all(documents, stream=None, **kwds):
"""
Serialize a Python object into a YAML stream.
Serialize a sequence of Python objects into a YAML stream.
Produce only basic YAML tags.
If stream is None, return the produced string instead.
"""
return dump_all([data], stream, Dumper=Dumper, **kwds)
return dump_all(documents, stream, Dumper=DangerDumper, **kwds)

def safe_dump_all(documents, stream=None, **kwds):
def dump(data, stream=None, Dumper=Dumper, **kwds):
"""
Serialize a sequence of Python objects into a YAML stream.
Produce only basic YAML tags.
Serialize a Python object into a YAML stream.
If stream is None, return the produced string instead.
"""
return dump_all(documents, stream, Dumper=SafeDumper, **kwds)
return dump_all([data], stream, Dumper=Dumper, **kwds)
safe_dump = dump

def safe_dump(data, stream=None, **kwds):
def danger_dump(data, stream=None, **kwds):
"""
Serialize a Python object into a YAML stream.
Produce only basic YAML tags.
If stream is None, return the produced string instead.
"""
return dump_all([data], stream, Dumper=SafeDumper, **kwds)
return dump_all([data], stream, Dumper=DangerDumper, **kwds)

def add_implicit_resolver(tag, regexp, first=None,
Loader=Loader, Dumper=Dumper):
Expand Down Expand Up @@ -312,4 +322,3 @@ def to_yaml(cls, dumper, data):
return dumper.represent_yaml_object(cls.yaml_tag, data, cls,
flow_style=cls.yaml_flow_style)
to_yaml = classmethod(to_yaml)

15 changes: 8 additions & 7 deletions lib/yaml/cyaml.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@

__all__ = ['CBaseLoader', 'CSafeLoader', 'CLoader',
'CBaseDumper', 'CSafeDumper', 'CDumper']
__all__ = ['CBaseLoader', 'CSafeLoader', 'CLoader', 'CDangerLoader',
'CBaseDumper', 'CSafeDumper', 'CDumper', 'CDangerDumper']

from _yaml import CParser, CEmitter

Expand All @@ -18,14 +18,15 @@ def __init__(self, stream):
BaseConstructor.__init__(self)
BaseResolver.__init__(self)

class CSafeLoader(CParser, SafeConstructor, Resolver):
class CLoader(CParser, SafeConstructor, Resolver):

def __init__(self, stream):
CParser.__init__(self, stream)
SafeConstructor.__init__(self)
Resolver.__init__(self)
CSafeLoader = CLoader

class CLoader(CParser, Constructor, Resolver):
class CDangerLoader(CParser, Constructor, Resolver):

def __init__(self, stream):
CParser.__init__(self, stream)
Expand All @@ -49,7 +50,7 @@ def __init__(self, stream,
default_flow_style=default_flow_style)
Resolver.__init__(self)

class CSafeDumper(CEmitter, SafeRepresenter, Resolver):
class CDumper(CEmitter, SafeRepresenter, Resolver):

def __init__(self, stream,
default_style=None, default_flow_style=None,
Expand All @@ -65,8 +66,9 @@ def __init__(self, stream,
SafeRepresenter.__init__(self, default_style=default_style,
default_flow_style=default_flow_style)
Resolver.__init__(self)
CSafeDumper = CDumper

class CDumper(CEmitter, Serializer, Representer, Resolver):
class CDangerDumper(CEmitter, Serializer, Representer, Resolver):

def __init__(self, stream,
default_style=None, default_flow_style=None,
Expand All @@ -82,4 +84,3 @@ def __init__(self, stream,
Representer.__init__(self, default_style=default_style,
default_flow_style=default_flow_style)
Resolver.__init__(self)

8 changes: 4 additions & 4 deletions lib/yaml/dumper.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@

__all__ = ['BaseDumper', 'SafeDumper', 'Dumper']
__all__ = ['BaseDumper', 'SafeDumper', 'Dumper', 'DangerDumper']

from emitter import *
from serializer import *
Expand All @@ -24,7 +24,7 @@ def __init__(self, stream,
default_flow_style=default_flow_style)
Resolver.__init__(self)

class SafeDumper(Emitter, Serializer, SafeRepresenter, Resolver):
class Dumper(Emitter, Serializer, SafeRepresenter, Resolver):

def __init__(self, stream,
default_style=None, default_flow_style=None,
Expand All @@ -41,8 +41,9 @@ def __init__(self, stream,
SafeRepresenter.__init__(self, default_style=default_style,
default_flow_style=default_flow_style)
Resolver.__init__(self)
SafeDumper = Dump

class Dumper(Emitter, Serializer, Representer, Resolver):
class DangerDumper(Emitter, Serializer, Representer, Resolver):

def __init__(self, stream,
default_style=None, default_flow_style=None,
Expand All @@ -59,4 +60,3 @@ def __init__(self, stream,
Representer.__init__(self, default_style=default_style,
default_flow_style=default_flow_style)
Resolver.__init__(self)

8 changes: 4 additions & 4 deletions lib/yaml/loader.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@

__all__ = ['BaseLoader', 'SafeLoader', 'Loader']
__all__ = ['BaseLoader', 'SafeLoader', 'Loader', 'DangerLoader']

from reader import *
from scanner import *
Expand All @@ -18,7 +18,7 @@ def __init__(self, stream):
BaseConstructor.__init__(self)
BaseResolver.__init__(self)

class SafeLoader(Reader, Scanner, Parser, Composer, SafeConstructor, Resolver):
class Loader(Reader, Scanner, Parser, Composer, SafeConstructor, Resolver):

def __init__(self, stream):
Reader.__init__(self, stream)
Expand All @@ -27,8 +27,9 @@ def __init__(self, stream):
Composer.__init__(self)
SafeConstructor.__init__(self)
Resolver.__init__(self)
SafeLoader = Loader

class Loader(Reader, Scanner, Parser, Composer, Constructor, Resolver):
class DangerLoader(Reader, Scanner, Parser, Composer, Constructor, Resolver):

def __init__(self, stream):
Reader.__init__(self, stream)
Expand All @@ -37,4 +38,3 @@ def __init__(self, stream):
Composer.__init__(self)
Constructor.__init__(self)
Resolver.__init__(self)

5 changes: 2 additions & 3 deletions tests/lib/test_constructor.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,9 @@ def _make_objects():
NewArgs, NewArgsWithState, Reduce, ReduceWithState, MyInt, MyList, MyDict, \
FixedOffset, today, execute

class MyLoader(yaml.Loader):
class MyLoader(yaml.DangerLoader):
pass
class MyDumper(yaml.Dumper):
class MyDumper(yaml.DangerDumper):
pass

class MyTestClass1:
Expand Down Expand Up @@ -272,4 +272,3 @@ def test_constructor_types(data_filename, code_filename, verbose=False):
sys.modules['test_constructor'] = sys.modules['__main__']
import test_appliance
test_appliance.run(globals())

7 changes: 3 additions & 4 deletions tests/lib/test_recursive.py
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,9 @@ def test_recursive(recursive_filename, verbose=False):
value2 = None
output2 = None
try:
output1 = yaml.dump(value1)
value2 = yaml.load(output1)
output2 = yaml.dump(value2)
output1 = yaml.danger_dump(value1)
value2 = yaml.danger_load(output1)
output2 = yaml.danger_dump(value2)
assert output1 == output2, (output1, output2)
finally:
if verbose:
Expand All @@ -47,4 +47,3 @@ def test_recursive(recursive_filename, verbose=False):
if __name__ == '__main__':
import test_appliance
test_appliance.run(globals())

0 comments on commit 7b68405

Please sign in to comment.