Скачать или смотреть Understanding the differences between yaml.load and yaml.safe_load in Python

This guide explores the fundamental differences between `yaml.load` and `yaml.safe_load` in Python's PyYAML package, helping you understand when to use each and the implications of switching between them.
---
This video is based on the question https://stackoverflow.com/q/63911610/ asked by the user 'iDev' ( https://stackoverflow.com/u/1030542/ ) and on the answer https://stackoverflow.com/a/63916315/ provided by the user 'flyx' ( https://stackoverflow.com/u/347964/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Python difference between yaml.load and yaml.safe_load

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Understanding the differences between yaml.load and yaml.safe_load in Python

When working with YAML files in Python, specifically using the PyYAML library, a common question arises regarding the two loading methods: yaml.load and yaml.safe_load. Users often face issues, such as truncation of trailing zeros, leading them to question the safety and appropriateness of using yaml.load. In this post, we will clarify the differences between these two functions and provide a recommended approach for loading YAML data safely.

The Problem at Hand

Consider a situation where you have a YAML file containing the following content:

[[See Video to Reveal this Text or Code Snippet]]

When loading this contents using:

[[See Video to Reveal this Text or Code Snippet]]

You get the output:

[[See Video to Reveal this Text or Code Snippet]]

Notice how the trailing zero is omitted! However, when you use yaml.load with yaml.BaseLoader, you obtain:

[[See Video to Reveal this Text or Code Snippet]]

Which yields:

[[See Video to Reveal this Text or Code Snippet]]

Clearly, the second method preserves the trailing zero, but is switching to yaml.load safe?

The Core Differences

1. Loading Methods

yaml.load(stream)

Loads YAML data and can execute arbitrary Python code.

Default loader yaml.Loader allows potentially unsafe operations.

Use this when you need full functionality, but be cautious of security risks.

yaml.safe_load(stream)

Loads YAML data without executing arbitrary Python code.

Uses yaml.SafeLoader by default, ensuring a safer loading process.

Ideal for untrusted input or when security is a concern, but it may lose certain data fidelity (like trailing zeros).

2. Safety Implications

Using yaml.safe_load ensures that you are not executing any arbitrary code that could potentially execute unwanted commands or actions on your system. The yaml.load method, on the other hand, does not restrict loading, which means unintended consequences could arise if the YAML content is crafted maliciously.

3. Custom Constructing

When using yaml.BaseLoader, you can still register custom constructors if you need specialized loading behavior, but be aware that this method also lacks the safe guards of yaml.safe_load.

Recommended Approach

When to Use yaml.safe_load

Whenever you load YAML data from untrusted sources.

When you don't require advanced YAML features that yaml.load may provide.

When to Consider yaml.load

If you need to maintain specific data formats (like trailing zeros).

If you're certain about the safety of the input and need the functionality provided by the full loader.

Conclusion

To preserve data integrity, while ensuring security, prefer using yaml.safe_load for most scenarios. If you do choose to use yaml.load, exercise caution and ensure that the data being loaded is entirely trustworthy.

In summary, your approach to switch to yaml.load for your specific case may work and address the issue of losing trailing zeros, but you must weigh that against the security implications of potentially executing arbitrary code. Always prioritize safety, especially when dealing with external or dynamically sourced YAML data.