Re: [PATCH net-next] tools: ynl: try to avoid the very slow YAML loader

[Jacob Keller <jacob.e.keller@intel.com>]

On 6/3/2026 4:35 PM, Jakub Kicinski wrote:
> On Wed, 3 Jun 2026 15:08:46 -0700 Jacob Keller wrote:
>> Hmm. I was a bit confused at first by the switch from safe_load to
>> load.. but we're passing Loader as _yaml_loader which will either be
>> CSafeLoader *or* the default SafeLoader, so we'll get the appropriate
>> loader equivalent to what safe_load would have done, so there's no
>> change. Ok
> 
> Maybe I should have mentioned this in the commit msg. I was also super
> confused by these APIs but IDK how much is this me not knowing Python
> and how much it's special. AFAIU basically:
> 

This is a pyyaml issue not a generic python one I think.

> somewhere in pyyaml...
> 
> 	def safe_load(file):
> 		return load(file, Loader=SafeLoader)
> 
> so safe_load() is just a "shorthand" for using SafeLoader, which unlike
> load()s default loader doesn't allow constructing real/binary Python
> objects ?

load() by default uses the generic Loader that supports the full spec
and because of that is "unsafe":

https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation

Basically, loading the full YAML spec on untrusted input is unsafe since
it allows arbitrary execution.
> 
> Why it doesn't default to the C one is beyond my understanding.

Right. I'm not super familiar here as to how it ends up not defaulting
to CSafeLoader, but probably its because its not always available.