YAML loader can run DESTROY method of object created with perl/* tag

[dod38fr]

Hi

YAML tags in the form perl/Foo::Bar enable an attacker to create an object with arbitrary data from an existing class. An attacker can't invoke a method from this object, except DESTROY method which is run when the object is destroyed or when the process exits.

And here's a example of using DESTROY:

use strict;
use warnings;
use 5.10.1;

package Foo::Bar;

sub DESTROY {
    say "Destroyed with ",$_[0]->{bar};
}

package main;

use YAML;
use Data::Dumper;

my $yaml = << "EOY";
---
obj: !perl/Foo::Bar
  bar: kaboom
EOY

say $yaml;

my $d = Load($yaml);
say Dumper $d;

Here's an example of abuse possibility using File::Temp::Dir: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861958

At the very least, could you add an option to disable object creation from YAML tag ?

A better solution would be to disable this feature by default and let user enable it when needed.

All the best

[dod38fr]

Note that this issue is similar to this one for YAML::XS except that Perl object are created with tag Foo::Bar instead of tag perl/Foo::Bar

[perlpunk]

Thanks; I suggested implementing $LoadBlessed like in YAML::Syck and YAML::XS

[perlpunk]

I have begun working on this at the Perl Toolchain Summit, adding the new option $YAML::LoadBlessed.
Work is almost done, I think.

[perlpunk]

Released YAML 1.24_001