YAML-RPC, PyYaml, and safe loading.

All,

I have working on an Python attempt at "YAML-RPC". It's pretty rough and inconsistent, but at least I have a client and a server that can interact with each other. I don't know where to put the code - donate it to PyYAML, perhaps?

Anyway, I've based part of my work on the JSON-RPC specs:

http://json-rpc.org/wd/JSON-RPC-1-1-WD-20060807.html

But with differences. Let me give a long explanation.

JSON (as we all know) uses maps and sequences to represent objects. It's not like YAML, with its tags. So to represent a procedure call (say, summing two numbers), the client sends this to the server:

{
    "version" : "1.1",
    "method"  : "sum",
    "params"  : [ 17, 25 ]
}

And receives back:

{
    "version" : "1.1",
    "result"  : 42
}

I thought I'd take a different tack, and create objects for (among other things) a YAML  Procedure Call. So I created the class:

class YAMLRPCCall(yaml.YAMLObject):
    """ This class represents YAML-RPC procedure calls. """
    yaml_tag = u'!yamlrpccall'
    def __init__(self, id, version, method, params):
        self.id = id
        self.version = version
        self.method = method
        self.params = params
 
And dumped it as:

--- !yamlrpccall
id: null
method: sum
params: [17, 25]  
version: '0.1'

And loaded it with yaml.load()

My problem is that this does not seem safe from a security point of view. YAML can load a lot more than JSON - probably dangerously so. So yaml.safe_load() will refuse to load this sort of YAML. However, sometimes some people (who do not know each other) may want to exchange data with explicit classes: a map representation is not enough information. So the need yaml.load(), but that's too dangerous...

So my questions to the group.

(a) Should YAML-RPC restrict itself to exchanging maps, sequences, and the usual lot of scalar (ints, floats). Should it be restricted from exchanging more complex objects?

(b) Alternatively, should YAML-RPC only be used in a controlled environment, between clients and severs that "know" each other? (As opposed to the more dangerous world of the Internet?)

(c) If an object of a certain type is desired, is it possible to arrange that yaml.safe_load() loads it, and nothing else? (Nothing else that is not already permitted by safe_load() already.)

A final note: if (a) is true, then YAML-RPC sounds like JSON-RPC, albeit with more formatting options (and anchors!). I might have been re-inventing the wheel!

Anyway, if anyone wants to look at the code, I'll produce it on demand. Any answers would be appreciated.

Cheers,
Peter


   


_______________________________________________________________ 
Hot new product - Spider Networks introduces stunning online ePortfolio solution for students and teachers


http://www.spider-networks.net/solutions/eportfolio.html

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV