Horton

Re: YAML Was: CommitFest status/management

Florian Weimer <fweimer@bfk.de>

View thread View on postgr.es
From: Florian Weimer <fweimer@bfk.de>
To: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Dimitri Fontaine <dfontaine@hi-media.com>, Greg Smith <greg@2ndquadrant.com>, Robert Haas <robertmhaas@gmail.com>, Itagaki Takahiro <itagaki.takahiro@oss.ntt.co.jp>, Josh Berkus <josh@agliodbs.com>, Tom Lane <tgl@sss.pgh.pa.us>, Ron Mayer <rm_pg@cheapcomplexdevices.com>, Andrew Dunstan <andrew@dunslane.net>, pgsql-hackers@postgresql.org
Date: 2009-12-08T07:28:36Z
Lists: pgsql-hackers 
* Alvaro Herrera:

> Florian Weimer escribió:
>> * Dimitri Fontaine:
>> 
>> > Well we have JSON and agreed it was a good idea to have it. Now JSON is
>> > a subset of YAML and some would prefer another YAML style (me included).
>> 
>> YAML is rather difficult to parse, and most parsers assume a trusted
>> document source because they support arbitrary class instantiations
>> (and it's not possible to switch this off, or it's rather involved to
>> do so).
>
> That's irrelevant because EXPLAIN YAML is already a trusted document
> source.

Uhm, really?  Do I have to expect code execution on the client when I
connect to a database?  I hope not.

-- 
Florian Weimer                <fweimer@bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99