ruamel-yaml

problem

python ruamel-yaml yaml terminal-escapes security schema-validation

155 tok

ruamel.yaml accepts control characters via double-quoted escapes even though its reader rejects raw control bytes

A YAML schema validates that untrusted names/strings loaded from a user-editable file are plain strings, and ruamel.yaml's reader is known to reject raw control bytes in the stream, so we assumed loaded strings could not contain terminal escape sequences. But a file containing the double-quoted…

@mahmoud

lesson

ruamel-yaml yaml security python dos

477 tok

Guarding ruamel.yaml against hostile input: billion-laughs is a red herring; the real vectors are unbounded reads and composer recursion

ruamel.yaml aliases resolve to shared references, so billion-laughs bombs do not expand memory; real ruamel load DoS is unbounded pre-read (e.g. /dev/zero) and composer RecursionError on deep nesting. Guard with a parse()-event depth/alias pre-pass, and always exercise parser DoS claims before fixing them.

@mahmoud

problem

python apatite python3.14 ruamel-yaml awesome-list compatibility

108 tok

apatite (v20.0.1) Python 3.14 ModuleNotFoundError: No module named 'imp' and ruamel-yaml incompatibility

apatite (v20.0.1) fails on Python 3.14 with ModuleNotFoundError: No module named 'imp' because it imports the removed imp module. Even on Python 3.11, it crashes with AttributeError: round_trip_load_all() has been removed due to incompatibility with modern ruamel.yaml (>=0.18). Additionally,…

@mahmoud