Skip to content

Commit ccc40f3

Browse files
ingydotnetingydotnet
committed
Reverting #74
Revert "Make pyyaml safe by default." This reverts commit bbcf95f. This reverts commit 7b68405. This reverts commit 517e83e.
1 parent a9c28e0 commit ccc40f3

12 files changed

Lines changed: 75 additions & 92 deletions

File tree

‎lib/yaml/__init__.py‎

Lines changed: 16 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -65,48 +65,40 @@ def load(stream, Loader=Loader):
6565
"""
6666
Parse the first YAML document in a stream
6767
and produce the corresponding Python object.
68-
69-
By default resolve only basic YAML tags, if an alternate Loader is
70-
provided, may be dangerous.
7168
"""
7269
loader = Loader(stream)
7370
try:
7471
return loader.get_single_data()
7572
finally:
7673
loader.dispose()
77-
safe_load = load
7874

7975
def load_all(stream, Loader=Loader):
8076
"""
8177
Parse all YAML documents in a stream
8278
and produce corresponding Python objects.
83-
84-
By default resolve only basic YAML tags, if an alternate Loader is
85-
provided, may be dangerous.
8679
"""
8780
loader = Loader(stream)
8881
try:
8982
while loader.check_data():
9083
yield loader.get_data()
9184
finally:
9285
loader.dispose()
93-
safe_load_all = load_all
9486

95-
def danger_load(stream):
87+
def safe_load(stream):
9688
"""
9789
Parse the first YAML document in a stream
9890
and produce the corresponding Python object.
99-
When used on untrusted input, can result in arbitrary code execution.
91+
Resolve only basic YAML tags.
10092
"""
101-
return load(stream, DangerLoader)
93+
return load(stream, SafeLoader)
10294

103-
def danger_load_all(stream):
95+
def safe_load_all(stream):
10496
"""
10597
Parse all YAML documents in a stream
10698
and produce corresponding Python objects.
107-
When used on untrusted input, can result in arbitrary code execution.
99+
Resolve only basic YAML tags.
108100
"""
109-
return load_all(stream, DangerLoader)
101+
return load_all(stream, SafeLoader)
110102

111103
def emit(events, stream=None, Dumper=Dumper,
112104
canonical=None, indent=None, width=None,
@@ -201,31 +193,29 @@ def dump_all(documents, stream=None, Dumper=Dumper,
201193
dumper.dispose()
202194
if getvalue:
203195
return getvalue()
204-
safe_dump_all = dump_all
205196

206-
def danger_dump_all(documents, stream=None, **kwds):
197+
def dump(data, stream=None, Dumper=Dumper, **kwds):
207198
"""
208-
Serialize a sequence of Python objects into a YAML stream.
209-
Produce only basic YAML tags.
199+
Serialize a Python object into a YAML stream.
210200
If stream is None, return the produced string instead.
211201
"""
212-
return dump_all(documents, stream, Dumper=DangerDumper, **kwds)
202+
return dump_all([data], stream, Dumper=Dumper, **kwds)
213203

214-
def dump(data, stream=None, Dumper=Dumper, **kwds):
204+
def safe_dump_all(documents, stream=None, **kwds):
215205
"""
216-
Serialize a Python object into a YAML stream.
206+
Serialize a sequence of Python objects into a YAML stream.
207+
Produce only basic YAML tags.
217208
If stream is None, return the produced string instead.
218209
"""
219-
return dump_all([data], stream, Dumper=Dumper, **kwds)
220-
safe_dump = dump
210+
return dump_all(documents, stream, Dumper=SafeDumper, **kwds)
221211

222-
def danger_dump(data, stream=None, **kwds):
212+
def safe_dump(data, stream=None, **kwds):
223213
"""
224214
Serialize a Python object into a YAML stream.
225215
Produce only basic YAML tags.
226216
If stream is None, return the produced string instead.
227217
"""
228-
return dump_all([data], stream, Dumper=DangerDumper, **kwds)
218+
return dump_all([data], stream, Dumper=SafeDumper, **kwds)
229219

230220
def add_implicit_resolver(tag, regexp, first=None,
231221
Loader=Loader, Dumper=Dumper):
@@ -322,3 +312,4 @@ def to_yaml(cls, dumper, data):
322312
return dumper.represent_yaml_object(cls.yaml_tag, data, cls,
323313
flow_style=cls.yaml_flow_style)
324314
to_yaml = classmethod(to_yaml)
315+

‎lib/yaml/cyaml.py‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11

2-
__all__ = ['CBaseLoader', 'CSafeLoader', 'CLoader', 'CDangerLoader',
3-
'CBaseDumper', 'CSafeDumper', 'CDumper', 'CDangerDumper']
2+
__all__ = ['CBaseLoader', 'CSafeLoader', 'CLoader',
3+
'CBaseDumper', 'CSafeDumper', 'CDumper']
44

55
from _yaml import CParser, CEmitter
66

@@ -18,15 +18,14 @@ def __init__(self, stream):
1818
BaseConstructor.__init__(self)
1919
BaseResolver.__init__(self)
2020

21-
class CLoader(CParser, SafeConstructor, Resolver):
21+
class CSafeLoader(CParser, SafeConstructor, Resolver):
2222

2323
def __init__(self, stream):
2424
CParser.__init__(self, stream)
2525
SafeConstructor.__init__(self)
2626
Resolver.__init__(self)
27-
CSafeLoader = CLoader
2827

29-
class CDangerLoader(CParser, Constructor, Resolver):
28+
class CLoader(CParser, Constructor, Resolver):
3029

3130
def __init__(self, stream):
3231
CParser.__init__(self, stream)
@@ -50,7 +49,7 @@ def __init__(self, stream,
5049
default_flow_style=default_flow_style)
5150
Resolver.__init__(self)
5251

53-
class CDumper(CEmitter, SafeRepresenter, Resolver):
52+
class CSafeDumper(CEmitter, SafeRepresenter, Resolver):
5453

5554
def __init__(self, stream,
5655
default_style=None, default_flow_style=None,
@@ -66,9 +65,8 @@ def __init__(self, stream,
6665
SafeRepresenter.__init__(self, default_style=default_style,
6766
default_flow_style=default_flow_style)
6867
Resolver.__init__(self)
69-
CSafeDumper = CDumper
7068

71-
class CDangerDumper(CEmitter, Serializer, Representer, Resolver):
69+
class CDumper(CEmitter, Serializer, Representer, Resolver):
7270

7371
def __init__(self, stream,
7472
default_style=None, default_flow_style=None,
@@ -84,3 +82,4 @@ def __init__(self, stream,
8482
Representer.__init__(self, default_style=default_style,
8583
default_flow_style=default_flow_style)
8684
Resolver.__init__(self)
85+

‎lib/yaml/dumper.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
__all__ = ['BaseDumper', 'SafeDumper', 'Dumper', 'DangerDumper']
2+
__all__ = ['BaseDumper', 'SafeDumper', 'Dumper']
33

44
from emitter import *
55
from serializer import *
@@ -24,7 +24,7 @@ def __init__(self, stream,
2424
default_flow_style=default_flow_style)
2525
Resolver.__init__(self)
2626

27-
class Dumper(Emitter, Serializer, SafeRepresenter, Resolver):
27+
class SafeDumper(Emitter, Serializer, SafeRepresenter, Resolver):
2828

2929
def __init__(self, stream,
3030
default_style=None, default_flow_style=None,
@@ -41,9 +41,8 @@ def __init__(self, stream,
4141
SafeRepresenter.__init__(self, default_style=default_style,
4242
default_flow_style=default_flow_style)
4343
Resolver.__init__(self)
44-
SafeDumper = Dumper
4544

46-
class DangerDumper(Emitter, Serializer, Representer, Resolver):
45+
class Dumper(Emitter, Serializer, Representer, Resolver):
4746

4847
def __init__(self, stream,
4948
default_style=None, default_flow_style=None,
@@ -60,3 +59,4 @@ def __init__(self, stream,
6059
Representer.__init__(self, default_style=default_style,
6160
default_flow_style=default_flow_style)
6261
Resolver.__init__(self)
62+

‎lib/yaml/loader.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
__all__ = ['BaseLoader', 'SafeLoader', 'Loader', 'DangerLoader']
2+
__all__ = ['BaseLoader', 'SafeLoader', 'Loader']
33

44
from reader import *
55
from scanner import *
@@ -18,7 +18,7 @@ def __init__(self, stream):
1818
BaseConstructor.__init__(self)
1919
BaseResolver.__init__(self)
2020

21-
class Loader(Reader, Scanner, Parser, Composer, SafeConstructor, Resolver):
21+
class SafeLoader(Reader, Scanner, Parser, Composer, SafeConstructor, Resolver):
2222

2323
def __init__(self, stream):
2424
Reader.__init__(self, stream)
@@ -27,9 +27,8 @@ def __init__(self, stream):
2727
Composer.__init__(self)
2828
SafeConstructor.__init__(self)
2929
Resolver.__init__(self)
30-
SafeLoader = Loader
3130

32-
class DangerLoader(Reader, Scanner, Parser, Composer, Constructor, Resolver):
31+
class Loader(Reader, Scanner, Parser, Composer, Constructor, Resolver):
3332

3433
def __init__(self, stream):
3534
Reader.__init__(self, stream)
@@ -38,3 +37,4 @@ def __init__(self, stream):
3837
Composer.__init__(self)
3938
Constructor.__init__(self)
4039
Resolver.__init__(self)
40+

‎lib3/yaml/__init__.py‎

Lines changed: 15 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -66,48 +66,40 @@ def load(stream, Loader=Loader):
6666
"""
6767
Parse the first YAML document in a stream
6868
and produce the corresponding Python object.
69-
70-
By default resolve only basic YAML tags, if an alternate Loader is
71-
provided, may be dangerous.
7269
"""
7370
loader = Loader(stream)
7471
try:
7572
return loader.get_single_data()
7673
finally:
7774
loader.dispose()
78-
safe_load = load
7975

8076
def load_all(stream, Loader=Loader):
8177
"""
8278
Parse all YAML documents in a stream
8379
and produce corresponding Python objects.
84-
85-
By default resolve only basic YAML tags, if an alternate Loader is
86-
provided, may be dangerous.
8780
"""
8881
loader = Loader(stream)
8982
try:
9083
while loader.check_data():
9184
yield loader.get_data()
9285
finally:
9386
loader.dispose()
94-
safe_load_all = load_all
9587

96-
def danger_load(stream):
88+
def safe_load(stream):
9789
"""
9890
Parse the first YAML document in a stream
9991
and produce the corresponding Python object.
100-
When used on untrusted input, can result in arbitrary code execution.
92+
Resolve only basic YAML tags.
10193
"""
102-
return load(stream, DangerLoader)
94+
return load(stream, SafeLoader)
10395

104-
def danger_load_all(stream):
96+
def safe_load_all(stream):
10597
"""
10698
Parse all YAML documents in a stream
10799
and produce corresponding Python objects.
108-
When used on untrusted input, can result in arbitrary code execution.
100+
Resolve only basic YAML tags.
109101
"""
110-
return load_all(stream, DangerLoader)
102+
return load_all(stream, SafeLoader)
111103

112104
def emit(events, stream=None, Dumper=Dumper,
113105
canonical=None, indent=None, width=None,
@@ -199,31 +191,29 @@ def dump_all(documents, stream=None, Dumper=Dumper,
199191
dumper.dispose()
200192
if getvalue:
201193
return getvalue()
202-
safe_dump_all = dump_all
203194

204-
def danger_dump_all(documents, stream=None, **kwds):
195+
def dump(data, stream=None, Dumper=Dumper, **kwds):
205196
"""
206-
Serialize a sequence of Python objects into a YAML stream.
207-
Produce only basic YAML tags.
197+
Serialize a Python object into a YAML stream.
208198
If stream is None, return the produced string instead.
209199
"""
210-
return dump_all(documents, stream, Dumper=DangerDumper, **kwds)
200+
return dump_all([data], stream, Dumper=Dumper, **kwds)
211201

212-
def dump(data, stream=None, Dumper=Dumper, **kwds):
202+
def safe_dump_all(documents, stream=None, **kwds):
213203
"""
214-
Serialize a Python object into a YAML stream.
204+
Serialize a sequence of Python objects into a YAML stream.
205+
Produce only basic YAML tags.
215206
If stream is None, return the produced string instead.
216207
"""
217-
return dump_all([data], stream, Dumper=Dumper, **kwds)
218-
safe_dump = dump
208+
return dump_all(documents, stream, Dumper=SafeDumper, **kwds)
219209

220-
def danger_dump(data, stream=None, **kwds):
210+
def safe_dump(data, stream=None, **kwds):
221211
"""
222212
Serialize a Python object into a YAML stream.
223213
Produce only basic YAML tags.
224214
If stream is None, return the produced string instead.
225215
"""
226-
return dump_all([data], stream, Dumper=DangerDumper, **kwds)
216+
return dump_all([data], stream, Dumper=SafeDumper, **kwds)
227217

228218
def add_implicit_resolver(tag, regexp, first=None,
229219
Loader=Loader, Dumper=Dumper):

‎lib3/yaml/cyaml.py‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11

2-
__all__ = ['CBaseLoader', 'CSafeLoader', 'CLoader', 'CDangerLoader',
3-
'CBaseDumper', 'CSafeDumper', 'CDumper', 'CDangerDumper']
2+
__all__ = ['CBaseLoader', 'CSafeLoader', 'CLoader',
3+
'CBaseDumper', 'CSafeDumper', 'CDumper']
44

55
from _yaml import CParser, CEmitter
66

@@ -18,15 +18,14 @@ def __init__(self, stream):
1818
BaseConstructor.__init__(self)
1919
BaseResolver.__init__(self)
2020

21-
class CLoader(CParser, SafeConstructor, Resolver):
21+
class CSafeLoader(CParser, SafeConstructor, Resolver):
2222

2323
def __init__(self, stream):
2424
CParser.__init__(self, stream)
2525
SafeConstructor.__init__(self)
2626
Resolver.__init__(self)
27-
CSafeLoader = CLoader
2827

29-
class CDangerLoader(CParser, Constructor, Resolver):
28+
class CLoader(CParser, Constructor, Resolver):
3029

3130
def __init__(self, stream):
3231
CParser.__init__(self, stream)
@@ -50,7 +49,7 @@ def __init__(self, stream,
5049
default_flow_style=default_flow_style)
5150
Resolver.__init__(self)
5251

53-
class CDumper(CEmitter, SafeRepresenter, Resolver):
52+
class CSafeDumper(CEmitter, SafeRepresenter, Resolver):
5453

5554
def __init__(self, stream,
5655
default_style=None, default_flow_style=None,
@@ -66,9 +65,8 @@ def __init__(self, stream,
6665
SafeRepresenter.__init__(self, default_style=default_style,
6766
default_flow_style=default_flow_style)
6867
Resolver.__init__(self)
69-
CSafeDumper = CDumper
7068

71-
class CDangerDumper(CEmitter, Serializer, Representer, Resolver):
69+
class CDumper(CEmitter, Serializer, Representer, Resolver):
7270

7371
def __init__(self, stream,
7472
default_style=None, default_flow_style=None,
@@ -84,3 +82,4 @@ def __init__(self, stream,
8482
Representer.__init__(self, default_style=default_style,
8583
default_flow_style=default_flow_style)
8684
Resolver.__init__(self)
85+

‎lib3/yaml/dumper.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
__all__ = ['BaseDumper', 'SafeDumper', 'Dumper', 'DangerDumper']
2+
__all__ = ['BaseDumper', 'SafeDumper', 'Dumper']
33

44
from .emitter import *
55
from .serializer import *
@@ -24,7 +24,7 @@ def __init__(self, stream,
2424
default_flow_style=default_flow_style)
2525
Resolver.__init__(self)
2626

27-
class Dumper(Emitter, Serializer, SafeRepresenter, Resolver):
27+
class SafeDumper(Emitter, Serializer, SafeRepresenter, Resolver):
2828

2929
def __init__(self, stream,
3030
default_style=None, default_flow_style=None,
@@ -41,9 +41,8 @@ def __init__(self, stream,
4141
SafeRepresenter.__init__(self, default_style=default_style,
4242
default_flow_style=default_flow_style)
4343
Resolver.__init__(self)
44-
SafeDumper = Dumper
4544

46-
class DangerDumper(Emitter, Serializer, Representer, Resolver):
45+
class Dumper(Emitter, Serializer, Representer, Resolver):
4746

4847
def __init__(self, stream,
4948
default_style=None, default_flow_style=None,
@@ -60,3 +59,4 @@ def __init__(self, stream,
6059
Representer.__init__(self, default_style=default_style,
6160
default_flow_style=default_flow_style)
6261
Resolver.__init__(self)
62+

0 commit comments

Comments
 (0)