test #34
test #34
Conversation
| import yaml | ||
|
|
||
|
|
||
| yaml.load(Loader=yaml.Loader) |
There was a problem hiding this comment.
fukkkdsafsadfadsadddblahDetected a possible YAML deserialization vulnerability. yaml.unsafe_load, yaml.Loader, yaml.CLoader, and yaml.UnsafeLoader are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use yaml.safe_load or yaml.SafeLoader instead. blah blah.blah
| yaml.load(Loader=yaml.Loader) | |
| yaml.load(Loader=yaml.Loader) |
|
|
||
| yaml.load(Loader=yaml.Loader) | ||
|
|
||
| yaml.unsafe_load("something") |
There was a problem hiding this comment.
fukkkdsafsadfadsadddblahDetected a possible YAML deserialization vulnerability. yaml.unsafe_load, yaml.Loader, yaml.CLoader, and yaml.UnsafeLoader are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use yaml.safe_load or yaml.SafeLoader instead. blah blah.blah
| yaml.unsafe_load("something") | |
| yaml.safe_load("something") |
No description provided.