This rule is designed to prevent the use of YAML functions in Ruby code. YAML functions such as YAML.load and YAML.load_file can be potentially dangerous as they have the ability to deserialize arbitrary objects, which can lead to code execution vulnerabilities if the input is not trusted.
Adhering to this rule is important to ensure the security of the application. When untrusted data is deserialized, it can lead to a variety of security exploits, including Remote Code Execution (RCE), which can provide an attacker with complete control over the application.
To avoid this, use safer methods such as Psych.safe_load or YAML.safe_load instead. These methods only allow the deserialization of simple, safe types. Additionally, always ensure that the data being deserialized is from a trusted source. By following these good coding practices, you can maintain the security and integrity of your Ruby application.
Non-Compliant Code Examples
YAML.load(data)YAML.load_file(filename)
Compliant Code Examples
Psych.safe_load('--- foo')YAML.load("something")
Seamless integrations. Try Datadog Code Analysis
Datadog Code Analysis
Try this rule and analyze your code with Datadog Code Analysis
How to use this rule
1
2
rulesets:- ruby-security # Rules to enforce Ruby security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
