From d71b4309ca3c4c7aafc446404f86499c7366a771 Mon Sep 17 00:00:00 2001 From: Aymeric Augustin Date: Tue, 1 Nov 2011 20:07:42 +0000 Subject: Used yaml.safe_load instead of yaml.load, because safety should be the default. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17062 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/releases/1.4.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'docs') diff --git a/docs/releases/1.4.txt b/docs/releases/1.4.txt index 254e85197d..c8e476263b 100644 --- a/docs/releases/1.4.txt +++ b/docs/releases/1.4.txt @@ -743,6 +743,16 @@ you can easily achieve the same by overriding the `open` method, e.g.:: def open(self, name, mode='rb'): return Spam(open(self.path(name), mode)) +YAML deserializer now uses ``yaml.safe_load`` +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +``yaml.load`` is able to construct any Python object, which may trigger +arbitrary code execution if you process a YAML document that comes from an +untrusted source. This feature isn't necessary for Django's YAML deserializer, +whose primary use is to load fixtures consisting of simple objects. Even though +fixtures are trusted data, for additional security, the YAML deserializer now +uses ``yaml.safe_load``. + .. _deprecated-features-1.4: Features deprecated in 1.4 -- cgit v1.3