XML is better than YAML

Re:XML is better than YAML by bshacklett on Friday September 22, 2023 @04:54PM (#37617639)

Any de-serialization should be done via safe loaders. Using `require()` or `eval()` isn't something I'd do outside of a very narrow set of scenarios.

[ Parent | on HN ]

Re:XML is better than YAML by arwineap on Saturday September 23, 2023 @04:19AM (#37621541)

The json modules in the same languages doesn't support the madness and doesn't necessitate a safe loader

It's possible someone could come along and write a json library that would support this, but somehow we have made it this far without it and that's a good thing

The point is that yaml and xml both have side effects in the form of require and eval that json won't, and frequently people are unaware of this

[ Parent | on HN ]

Re:XML is better than YAML by bshacklett on Wednesday September 27, 2023 @09:10AM (#37674143)

I feel I must still be misunderstanding something. OWASP has pages of resources which talk about the lack of safety of JSON:

https://owasp.org/search/?searchString=json

Perhaps yaml and xml have _more_ ways to inject behavior into an application, but I would still not consider JSON safe in any way. Why would JSON.parse() even exist if `require()` and `eval()` were safe to use?

[ Parent | on HN ]