Skip to content

[flake8-bandit/S506] Dont report violation when using BaseLoader #13604

@mcmitch

Description

@mcmitch

From https://pyyaml.org/wiki/PyYAMLDocumentation

  • Loader supports all predefined tags and may construct an arbitrary Python object. Therefore it is not safe to use Loader to load a document received from an untrusted source. By default, the functions scan, parse, compose, construct, and others use Loader.
  • SafeLoader(stream) supports only standard YAML tags and thus it does not construct class instances and probably safe to use with documents received from an untrusted source. The functions safe_load and safe_load_all use SafeLoader to parse a stream.
  • BaseLoader(stream) does not resolve or support any tags and construct only basic Python objects: lists, dictionaries and Unicode strings.

For our project we are using the Baseloader, and do not want to use safeLoader, as this would not leave integer values as strings. The baseloader is not the unsafe FullLoader, and should not be flagged as an exception to S506.

Code to reproduce:

with open('testfile.yaml') as fhandle:
  loader_yaml = yaml.load(fhandle, Loader=yaml.Baseloader)

Ruff setting: [select = "S506"]
Ruff version: 0.6.8

Metadata

Metadata

Assignees

No one assigned

    Labels

    acceptedReady for implementationruleImplementing or modifying a lint rule

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions