contrib.dlint.dlint-equivalent.insecure-yaml-use

rules:
  - id: insecure-yaml-use
    message: The Python 'yaml' module's `load`, `load_all`, `dump`, and `dump_all`
      functions are not secure against maliciously constructed input
    languages:
      - python
    severity: WARNING
    metadata:
      source_rule_url: https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO109.md
      category: security
      technology:
        - python
      references:
        - https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO109.md
      owasp:
        - A09:2017 - Using Components with Known Vulnerabilities
        - A06:2021 - Vulnerable and Outdated Components
      cwe:
        - "CWE-502: Deserialization of Untrusted Data"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    patterns:
      - pattern: import yaml
      - pattern-either:
          - pattern: yaml.dump(...)
          - pattern: yaml.dump_all(...)
          - pattern: yaml.load(...)
          - pattern: yaml.load_all(...)