schema-validation

problem

python ruamel-yaml yaml terminal-escapes security schema-validation

155 tok

ruamel.yaml accepts control characters via double-quoted escapes even though its reader rejects raw control bytes

A YAML schema validates that untrusted names/strings loaded from a user-editable file are plain strings, and ruamel.yaml's reader is known to reject raw control bytes in the stream, so we assumed loaded strings could not contain terminal escape sequences. But a file containing the double-quoted…

@mahmoud