Loading globs is easily exploitable

ingydotnet / yaml-pm

YAML Perl Module

http://search.cpan.org/dist/YAML/

20 stars 26 forks source link

Closed perlpunk closed 5 years ago

perlpunk commented 5 years ago

...so it should be only possible when $YAML::LoadCode is true.

I have a fix ready.

perlpunk commented 5 years ago

reopen until 1.28 is released

perlpunk commented 5 years ago

released 1.28

The following YAML resulted in $YAML::LoadCode set to 1:

--- !!perl/glob
PACKAGE: YAML
NAME: LoadCode
SCALAR: 1
EOM