Re: [PATCH net-next] tools: ynl: try to avoid the very slow YAML loader

[Nicolai Buchwitz <nb@tipi-net.de>]

On 4.6.2026 02:17, Jacob Keller wrote:
> On 6/3/2026 4:35 PM, Jakub Kicinski wrote:
>> On Wed, 3 Jun 2026 15:08:46 -0700 Jacob Keller wrote:
>>> Hmm. I was a bit confused at first by the switch from safe_load to
>>> load.. but we're passing Loader as _yaml_loader which will either be
>>> CSafeLoader *or* the default SafeLoader, so we'll get the appropriate
>>> loader equivalent to what safe_load would have done, so there's no
>>> change. Ok
>> 
>> Maybe I should have mentioned this in the commit msg. I was also super
>> confused by these APIs but IDK how much is this me not knowing Python
>> and how much it's special. AFAIU basically:
>> 
> 
> This is a pyyaml issue not a generic python one I think.
> 
>> somewhere in pyyaml...
>> 
>> 	def safe_load(file):
>> 		return load(file, Loader=SafeLoader)
>> 
>> so safe_load() is just a "shorthand" for using SafeLoader, which 
>> unlike
>> load()s default loader doesn't allow constructing real/binary Python
>> objects ?
> 
> load() by default uses the generic Loader that supports the full spec
> and because of that is "unsafe":
> 
> https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
> 
> Basically, loading the full YAML spec on untrusted input is unsafe 
> since
> it allows arbitrary execution.
>> 
>> Why it doesn't default to the C one is beyond my understanding.
> 
> Right. I'm not super familiar here as to how it ends up not defaulting
> to CSafeLoader, but probably its because its not always available.

That's correct. CSafeLoader is only available if libyaml-dev was present 
when
pyyaml was built. Auto-enabling the libyaml bindings was requested a few 
years
ago, but it stalled due to internals [1]. It would also require 
reworking
safe_load() and others, which are atm hardcoded. Hence the usual 
try/except
import pattern.

Anyway, the changes match the usual patterns.

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

[1] https://github.com/yaml/pyyaml/issues/437

Regards
Nicolai