-
Notifications
You must be signed in to change notification settings - Fork 575
Why does PyYAML 5.1 raise YAMLLoadWarning when the default loader has been made safer already? #292
Description
Here is my code:
import yaml
yaml.load('foo')
This code leads to the following warning with PyYAML (5.1).
$ pip install pyyaml
$ python3 foo.py
foo.py:2: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.
yaml.load('foo')
So I visited https://msg.pyyaml.org/load to see what this is about but I do not understand the need for this warning.
First, the documentation says,
UnsafeLoader(also calledLoaderfor backwards compatability)The original Loader code that could be easily exploitable by untrusted data input.
Okay, that makes sense. In an earlier version, the original loader was unsafe. Further, it says,
FullLoaderLoads the full YAML language. Avoids arbitrary code execution. This is currently (PyYAML 5.1) the default loader called by
yaml.load(input)(after issuing the warning).
So the current version uses FullLoader which is not unsafe. This is confirmed again in the document.
The load function was also made much safer by disallowing the execution of arbitrary functions by the default loader (
FullLoader).
If the current version that uses FullLoader is not unsafe, then why do we need the YAMLLoadWarning at all?