Serialization formats aren't toys
summary
APIs that accept XML, YAML or JSON are vulnerable unless the parser is deliberately dumb. YAML parsers like PyYAML will import modules and construct objects so yaml.load vs yaml.safe_load is literally the difference between returned dicts and arbitrary os.system commands. XML supports entity recursion and external entity expansion so a billion laughs (168 million expansion) blows memory and XXE can leak /etc/passwd or probe internal ports. Use libraries like defusedxml or safe parsers and never eval JSON.
AI-written summary · about
chapters (10)
- 0:00Start
- 8:00Parsing YAML
- 10:24November 2011
- 10:58January 2013
- 12:51Disable YAML tag parsing
- 14:26Defining entities
- 17:47External entities
- 21:30How do I protect myself?
- 21:59Make the parser stupider
- 24:05eval() is not a stupid enough parser.
related talks
40m[In]secure Deserialization, And How [Not] To Do It
29mRCE via legacy dependency in Python
35mDangerous Serialization
47mHow XML processing leads to security issues: unpacking XXE
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
51mMarshalling Pickles
29mThis DoS goes loop-di-loop – preventing DoS attacks in your Node.js application
26mTesting Python Security