Skip to content

Commit 54e6f51

Browse files
committed
Python: Add example of C-based PyYAML loaders
``` In [6]: yaml.load("!!python/object/new:os.system [echo EXPLOIT!]", yaml.CLoader) EXPLOIT! Out[6]: 0 ```
1 parent 25b15d7 commit 54e6f51

File tree

1 file changed

+6
-0
lines changed
  • python/ql/test/experimental/library-tests/frameworks/yaml

1 file changed

+6
-0
lines changed

python/ql/test/experimental/library-tests/frameworks/yaml/Decoding.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,9 @@
1717
yaml.safe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML
1818
yaml.unsafe_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
1919
yaml.full_load_all(payload) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
20+
21+
# C-based loaders with `libyaml`
22+
yaml.load(payload, yaml.CLoader) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
23+
yaml.load(payload, yaml.CFullLoader) # $ decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML decodeMayExecuteInput
24+
yaml.load(payload, yaml.CSafeLoader) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML SPURIOUS: decodeMayExecuteInput
25+
yaml.load(payload, yaml.CBaseLoader) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=YAML SPURIOUS: decodeMayExecuteInput

0 commit comments

Comments
 (0)