Safeloading

Safe loading, sometimes written safeloading, denotes practices for loading data or modules from potentially untrusted sources in a way that prevents security breaches such as remote code execution, data exfiltration, or object injection. The concept applies across data formats, configuration systems, and plugin architectures, where unchecked loading can trigger side effects or instantiate attacker-controlled code.

In YAML processing, a common concern is that a loader could instantiate arbitrary objects or execute constructors during parsing. In Python's PyYAML library, unsafe loading is performed by yaml.load with a non-Safe Loader. Safer alternatives include yaml.safe_load or using Loader=SafeLoader, which restricts the parser to basic data types like strings, numbers, lists, and dicts. Similar principles apply to YAML libraries in other languages: enabling only data-oriented features and avoiding constructors or side-effectful hooks during parsing.

In JSON, the data model is typically data-only, so standard loaders are generally safe by default. Nonetheless, developers should validate input, limit payload size, and ensure downstream code cannot be influenced by untrusted data. In XML, safe loading requires protection against XML External Entity attacks by disabling external entities and DTD processing, and by using secure parsers and configurations.

Best practices for safeloading include validating input with a schema, using allowlists for permissible structures, running parsing in a sandbox or with restricted permissions, avoiding conversion to runtime objects from untrusted data, and keeping dependencies up to date. Safeloading is a balance between functionality and security, prioritizing necessary features while minimizing exposure to risks.