Sep 7, 20244 min read

YAML: The Friendly Data Format and How to Use It Securely

If you've ever dealt with configuration files, you've likely encountered YAML. It's a simple, human-readable data format that makes life easier when setting up applications, defining workflows, or configuring infrastructure. But, like any tool, it has its own quirks and security considerations. In this post, we'll explore YAML's structure and usage and how to use it securely with real-world examples.

What is YAML?

YAML stands for "YAML Ain't Markup Language or yet another markup language, "a human-friendly data serialization standard. In simpler terms, it's a way to write structured data (like configuration settings) in a format that's easy to read and write. YAML is used in tools like Kubernetes, Docker, and Ansible. Its simplicity is its biggest strength.

YAML's Basic Structure

At its core, YAML uses indentation to represent data hierarchy. Let's break down a basic YAML file:

# A simple YAML configuration file

server:
  host: localhost
  port: 8080

database:
  name: my_database
  user: admin
  password: secret

features:
  - interactive
  - conversational
  - scalable

Mappings (Key-Value Pairs): Data is stored in key-value pairs, just like a dictionary in Python.
Sequences (Lists): Lists of items are represented with dashes (`-`).
Scalars: Basic data types like strings, integers, and booleans.

YAML also supports more advanced features, such as multiline strings, anchors, and aliases (we'll touch on these later).

YAML Structure with Examples

To understand YAML, let's dive into its different structures with examples:

Scalars (Basic Data Types)
YAML can handle simple data types like strings, numbers, booleans, and null values.

string_plain: Hello, World   # Plain string
string_quoted: "This is a quoted string"
integer_value: 42            # Integer
floating_value: 3.14159      # Float
boolean_true: true           # Boolean true
boolean_false: false         # Boolean false
null_value: null             # Explicit null value
empty_value:                 # Implicit null value

Sequences (Lists)
YAML represents lists with a dash (`-`) before each item.

fruits:
  - Apple
  - Orange
  - Banana
  - Mango

You can also have nested sequences (lists within lists):

colors:
  - primary:
      - Red
      - Green
      - Blue
  - secondary:
      - Yellow
      - Purple
      - Cyan

Mappings (Key-Value Pairs)
YAML maps keys to values, similar to a dictionary:

person:
  name: Alice
  age: 30
  married: false

And you can nest mappings:

address:
  street: 123 Main St
  city: Metropolis
  country: Wonderland

Multiline Strings
YAML supports multiline strings using `|` (literal block) or `>` (folded block).

description_literal: |
  This is a literal block string.
  Line breaks are preserved exactly as written.
  Useful for long text blocks like this.

description_folded: >
  This is a folded block string. Newlines
  are converted into spaces when parsed.

Anchors and Aliases
YAML allows you to reuse data with anchors (`&`) and aliases (`*`). This helps avoid repetition and keeps your YAML DRY (Don't Repeat Yourself).

default_settings: &default_settings
  retries: 5
  timeout: 30s

service_1:
  <<: *default_settings
  url: https://service1.example.com
service_2:
  <<: *default_settings
  url: https://service2.example.com

In this example, `service_1` and `service_2` reuse the `default_settings` anchor.

YAML in Action: Using Conditional Logic

YAML doesn't natively support conditional logic (like `if-else` statements), but many tools allow you to combine YAML with templating engines or scripting to add logic.

For example, in Ansible (which uses YAML for automation), you can add conditional logic with the `when` keyword:

tasks:
  - name: Install Apache on Ubuntu
    apt:
      name: apache2
      state: present
    when: ansible_os_family == "Debian"

Here, the task only runs if the operating system is Debian-based.

YAML Security: What You Need to Know

While YAML is convenient, it has some security risks, especially when dealing with untrusted input. Here are the key security concerns and how to mitigate them:

Arbitrary Code Execution
Some YAML parsers can execute code when deserializing YAML files. This can be a significant security risk if an attacker controls the input. For example, in Python:

!!python/object/apply:os.system ["rm -rf /"]

If loaded improperly, this YAML could run the `rm -rf /` command, which could wipe your system. To prevent this, always use **safe loading** methods:

import yaml

with open('config.yaml') as file:
    config = yaml.safe_load(file)  
# Use safe_load() to avoid code execution

Deserialization Attacks
Deserializing untrusted YAML data can lead to unexpected behaviour or even security vulnerabilities. If you don't need complex object types, stick to basic types like strings, numbers, lists, and dictionaries.

Sensitive Data Exposure
YAML files often contain sensitive information like passwords and API keys. Make sure to secure these files by:
- Using proper file permissions.
- Avoid hardcoding sensitive data in plaintext YAML files.
- Using secret management tools like HashiCorp Vault or AWS Secrets Manager.

Limit Resource Consumption
If the parser is overwhelmed, YAML allows complex structures, leading to denial-of-service (DoS) attacks. To protect against this, limit file size, nesting depth, or the number of nodes in your YAML.

Disable Unnecessary Features
Many YAML parsers allow turning off advanced features (like custom tags) that aren't needed for simple data storage, reducing the attack surface.

Final Thoughts

YAML is powerful, flexible, and easy to read, but with great power comes great responsibility! By following best practices—like using safe parsing methods, validating input, and securing sensitive data—you can use YAML effectively and securely. Whether configuring an application, automating tasks, or working with infrastructure-as-code, YAML is a great tool to have in your toolbox—handle it carefully!

Happy YAML-ing!

YAML: The Friendly Data Format and How to Use It Securely