Repository navigation
feat: make the several-document YAML loaders deserialization sinks - #124
Merged
Merged
Conversation
yaml.load_all, full_load_all and unsafe_load_all reached by HTTP input are insecure deserializations; load_all with a safe loader and safe_load_all are not.
yaml.load_all, yaml.full_load_all and yaml.unsafe_load_all load a stream of documents as their single-document versions do, but attacker input reaching them went unreported. They are sinks now; yaml.load_all shares the safe loaders of yaml.load through one constant. The usage guide lists the loaders the rule covers and the safe-loader exception. Closes #123
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #123.
yaml.load_all,yaml.full_load_allandyaml.unsafe_load_allwere not sinks: attacker input reaching them went unreported, while their single-document versions were. They areDESERIALIZATIONsinks now;yaml.load_allgets the sameSafeArgumentasyaml.load(#121), both reading one_SAFE_YAML_LOADERSconstant;yaml.safe_load_allstays a non-sink.Tests (end to end,
tests/test_safe_arguments.py): each of the three loaders reached byrequest.datais one finding;load_allwithSafeLoaderandsafe_load_allare none. The usage guide's rule table lists the loaders covered and the safe-loader exception. 973 passed; ruff and mypy clean. No regression-corpus project calls these loaders.