Accept YAML input from website user
<p>I haven't written this in the code yet but I want to parse YAML from my website users. The YAML should just be string key/values and lists of strings.</p>

<p>They input YAML into a textbox, send it to the server, then the python will parse the YAML, put it in the database and it will later be queryable.</p>

<p>Is there anything I need to do to be able to safely do the above?</p>

<p>The main thing to observe is to parse the yaml with either <code>safe_load</code> ( <a href="https://pypi.python.org/pypi/ruamel.yaml/" rel="nofollow">ruamel.yaml</a> (supporting YAML 1.2), <a href="http://pyyaml.org/" rel="nofollow">PyYAML</a> (YAML 1.1)) or <code>round_trip_load</code> (ruamel.yaml, this will allow you to extract comments in the YAML file if necessary). </p>

<p>The normal <code>load</code> could be used to execute programs by the Python interpreter, unless you pre-process the YAML to remove any tags.</p>

<hr>

<p><sub>Disclaimer: I am the author of ruamel.yaml</sub></p>

python security yaml