[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#861958: lintian: insecure YAML validation



clone 861958 -1
reassign -1 libyaml-syck-perl
retitle -1 libyaml-syck-perl: Unconditionally instantiates objects from yaml data
thanks

This problem exists in libyaml-syck-perl as well. However, disabling
this feature will be easier since there's already a switch ("LoadBlessed").

    Christoph
#!/usr/bin/perl

use 5.010;
use strict;
use warnings;

use File::Temp qw(tempdir);
use YAML::XS qw(LoadFile);

my $temp_dir = tempdir (
    "yaml-xs-demo.$$.XXXXX",
    'TMPDIR' => 1,
    'CLEANUP' => 1,
);

my $temp_file = "$temp_dir/story.yaml";

my $pid = fork // die ("Cannot fork: $!");
if ($pid == 0) {
    my $fh;
    open ($fh, '>', $temp_file) or die $!;
    print $fh <<__EOS__;
- !File::Temp::Dir
  CLEANUP: 1
  LAUNCHPID: $$
  REALNAME: $temp_dir
__EOS__
    close ($fh);
    my $data = LoadFile ($temp_file);
    exit 0;
}
wait;

if (-d $temp_dir) {
    print "I: Pass, temp dir is still present\n";
} else {
    print "F: FAIL, temp dir was purged\n";
}

Attachment: signature.asc
Description: Digital signature


Reply to: