Default to safe=True?

[ypid]

Currently, pyaml.dump defaults to safe=False. Maybe it could be changed to safe=True by default (security by default)?

Would there be any noticeable difference from that and do you think safe=True would limit normal use cases?

If you disagree with changing the default, maybe the docs can be updated to use the safe=True where possible?

See also: Make load safe_load

Thanks for your nice library!

[mk-fg]

Hi, thanks for comment, but are you sure safe=True is about security?

[mk-fg]

Iirc it makes pyyaml output as simple types as possible, so that even dumbest stripped-down parsers can read it, i.e. "safe" in a "most compatible" sense.

[mk-fg]

Which, iirc also makes resulting YAML as ugly as possible, which clearly contradicts the goal of the module.

[mk-fg]

Also, totally agree on load vs safe_load, always use the latter myself, but don't think it's related, though will need to check it, not 100% sure.

[ypid]

Hi, thanks for comment, but are you sure safe=True is about security?

I don’t really think so. The issues with unsafe load are much more severe.

[mk-fg]

I don’t really think so. The issues with unsafe load are much more severe.

But this module doesn't do loading at all! ;)

[ypid]

But this module doesn't do loading at all! ;)

Seen that :) I also noticed that you use safe_dump in your examples. Nicely done 👍

[mk-fg]

Just noticed that safe= is actually a flag in pyaml, and I think it's and unfortunately named option, which I've copied from PyYAML's similarly-named safe_dump thing, which does similar "most compatible" output.

pyaml, similarly, uses UnsafePrettyYAMLDumper, which dabbles with scalar and sequence styles, and can occasionally produce broken output, hence the option to avoid it.

Don't think renaming it now is a good idea though, and it's at least somewhat consistent that way, if nothing else, so guess I'll just leave it be.

[mk-fg]

Also, PrettyYAMLDumper and co always based on yaml.dumper.SafeDumper, and I dare you to look at the things with exclamation marks non-safe pyyaml dumper produces, it's just ridiculous.

[ypid]

Sounds reasonable. Thanks for explaining.