Skip to content

fix: explicitly use FAILSAFE_SCHEMA for yaml.load() security hardening#2406

Open
khushal-winner wants to merge 1 commit intoOWASP:masterfrom
khushal-winner:fix/yaml-security-hardening
Open

fix: explicitly use FAILSAFE_SCHEMA for yaml.load() security hardening#2406
khushal-winner wants to merge 1 commit intoOWASP:masterfrom
khushal-winner:fix/yaml-security-hardening

Conversation

@khushal-winner
Copy link
Contributor

Replace implicit yaml.load() calls with explicit FAILSAFE_SCHEMA for defense-in-depth security. This follows OWASP secure coding practices and provides clear audit trail.

resolves: #2396

Affected files:

  • deckService.ts:82
  • mappingService.ts:13,27,63
  • capecService.ts:30

Benefits:

  • Explicit security documentation
  • Protection against accidental version downgrades
  • Clear audit trail

Replace implicit yaml.load() calls with explicit FAILSAFE_SCHEMA
for defense-in-depth security. This follows OWASP secure coding
practices and provides clear audit trail.

Affected files:
- deckService.ts:82
- mappingService.ts:13,27,63
- capecService.ts:30

Benefits:
- Explicit security documentation
- Protection against accidental version downgrades
- Clear audit trail

Signed-off-by: Khushal Malhotra <redmi5a3217@gmail.com>
khushal-winner added a commit to khushal-winner/cornucopia that referenced this pull request Feb 27, 2026
- Add Pydantic as dev dependency (v2.12.5)
- Create comprehensive Pydantic models for card validation:
  - Card: Individual card structure with id, value, url, desc, misc, and optional card type
  - Suit: Container for cards with id and name
  - Meta: File metadata (edition, component, language, version)
  - CornucopiaData: Main model allowing extra top-level fields
- Integrate validation into convert.py get_language_data function
- Add 21 comprehensive unit tests covering all models and edge cases
- Validation complements existing FAILSAFE_SCHEMA (OWASP#2406)
- Strict validation for card structures while allowing flexibility for additional sections

Testing:
- All 21 tests pass
- Successfully validates real webapp-cards-3.0-en.yaml file
- Handles Joker cards with 'card' field
- Provides clear error messages for validation failures
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security Hardening: Add Explicit Safe Schema to yaml.load() Calls

1 participant