Yaml serializer fails since pyyaml 4.1

Yesterday pyyaml was updated to version 4.1 And now I’m receiving this error: yaml.representer.RepresenterError: ('cannot represent an object', URL('<url>') The problem is in the vcr/serializers/yamlserializer.py file. When the method serialize method is called.

I found this pull request that was pushed in the version 4.1 of pyyaml: https://github.com/yaml/pyyaml/pull/74 where they change the behaviour dump, Dumper, CDumper and the same with the loaders. Before the update this methods were “danger” and now are “safe” then we can change the line in the serializer to the “danger” version because is exactly the same that we use before this update. I’ll try to fix it later.

[lmazuel]

@stefangordon @jbagot found out the problem.

After some investigation, it impacts only files recorded with Python 2.7. Because starting PyYAML 4.x, the methods “load/safe_load” becomes respectively “danger_load/load” (i.e. by default creating Python object from YAML parsing is disabled). In Py 2.7, YAML of VCRPy contains this:

body: {string: !!python/unicode 'stuff'.....

Which will not be parsed anymore by default (since it creates a Python object and is vulnerable to attack).

This means that with PyYAML 3.x series, if a malicious person introduce bad python code in the recordings, each time the recordings are replayed the code is executed (?!?!??). And you see here, this could simple as:

favorite_activity: !!python/object/apply:os.system ['rm *']

I’m not sure if it means that VCRPy is not compatible anymore with Py2.7 if PyYAML is installed, or if this means that PyYAML should be pinned to 3.12 on Py2.7 and >=4.0 on Py3. Or if you just document (as PyYAML did) that playing recording is vulnerable to attack if PyYAML is < 4.0.

[lamenezes]

I believe this was fixed by PyYAML. If the problem persists feel free to open another issue. Thanks everyone for the discussion 😃