I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". Wikipedia also explains that
YAML allows language specific tags so that arbitrary local objects can be created by a parser that supports those tags. Any YAML parser that allows sophisticated object instantiation to be executed opens the potential for an injection attack.
Consequently, it appears that it is potentially unsafe to parse untrusted input using some YAML parsers.
Can anyone explain how to safely parse untrusted YAML input, in Rails, Python, and Perl? Are there YAML parsing libraries that are safe, or ways to invoke them that ensures they are safe even if the input is from an untrusted source?