The pure-Perl YAML implementation (YAML
module as opposed to YAML::Syck
) seems to have some serious problems. I recently ran into issues where it could not process YAML documents with very long lines (32k characters or so).
YAML is able to store and load blessed variables and does so by
default (The snippet below was copied from a *sepia-repl*
buffer in
Emacs):
I need user feedback! Please send questions or comments to seano@cpan.org.
Sepia version 0.98.
Type ",h" for help, or ",q" to quit.
main @> use YAML
undef
main @> $foo = bless {}, 'asdf'
bless( {}, 'asdf' )
main @> $foo_dump = YAML::Dump $foo
'--- !!perl/hash:asdf {}
'
main @> YAML::Load $foo_dump
bless( {}, 'asdf' )
This is quite scary security-wise because untrusted data can be used
to call any DESTROY
method that has been defined in your application
-- or any of the modules it uses.
The following short program demonstrates the problem:
#!/usr/bin/perl
use YAML;
use Data::Dumper;
package My::Namespace;
sub DESTROY {
print Data::Dumper::Dumper \@_;
}
package main;
my $var = YAML::Load '--- !!perl/hash:My::Namespace
bar: 2
foo: 1
';
JSON does not allow this by default -- it is possible to serialize
Perl "objects", but in order to do that, you have to define TO_JSON
methods.