What can happen when loading a YAML file from an untrusted source with SnakeYAML?

Question

The SnakeYAML documentation says:

Warning: It is not safe to call Yaml.load() with any data received from an untrusted source!

Is it security issues? What can a malicious YAML file do?

Answer 1

SnakeYAML allows to use any class loader. When the instance of a class is created, it calls the constructor. It will run any code there. If you load classes yourself - no worries.

Answer 2

I was wondering about this, too, and found the following in the documentation:

Note if you want to limit objects to standard Java objects like List or Long you need to use SafeConstructor.

Yaml yaml = new Yaml(new SafeConstructor());

The link quoted above goes to a test case in which a YAML document contains a reference to a Java object. Without SafeConstructor, yaml.load would call the object's no-argument constructor and this might be a bad thing for some classes in your classpath. With SafeConstructor, only the SafeConstructor nested classes (Java code) would ever be called.