-
Notifications
You must be signed in to change notification settings - Fork 557
Open
Description
Summary
Timestamp and !!python/complex constructors lack guard clauses; invalid inputs lead to NoneType attribute access or ValueError from complex().
poc:
import yaml
yaml.safe_load("!!timestamp 'invalid'")
yaml.load("!!python/complex 'invalid'", Loader=yaml.FullLoader)Traceback:
$ uv run python
Python 3.10.18 (main, Sep 2 2025, 14:19:37) [Clang 20.1.4 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import yaml
>>> yaml.safe_load("!!timestamp 'invalid'")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/home/User/.venv/lib/python3.10/site-packages/yaml/__init__.py", line 125, in safe_load
return load(stream, SafeLoader)
File "/home/User/.venv/lib/python3.10/site-packages/yaml/__init__.py", line 81, in load
return loader.get_single_data()
File "/home/User/.venv/lib/python3.10/site-packages/yaml/constructor.py", line 51, in get_single_data
return self.construct_document(node)
File "/home/User/.venv/lib/python3.10/site-packages/yaml/constructor.py", line 55, in construct_document
data = self.construct_object(node)
File "/home/User/.venv/lib/python3.10/site-packages/yaml/constructor.py", line 100, in construct_object
data = constructor(self, node)
File "/home/User/.venv/lib/python3.10/site-packages/yaml/constructor.py", line 325, in construct_yaml_timestamp
values = match.groupdict()
AttributeError: 'NoneType' object has no attribute 'groupdict'
Suggested Fix
- Confirm regex matches before dereferencing groups in
construct_yaml_timestamp. - Wrap
complex()calls intry/exceptand surfaceConstructorError.
Metadata
Metadata
Assignees
Labels
No labels