Arbitrary types

[mathstuf]

I don't see whether serde-yaml supports user types or not (it seems not to me), but is this article relevant?

https://community.embarcadero.com/blogs/entry/yaml-and-remote-code-execution-38738

[dtolnay]

Serde in general is not vulnerable to arbitrary object instantiation / remote code execution. That applies to serde-yaml and all other Serde data formats. The code that deserializes untrusted input always specifies what type is expected i.e. which Deserialize impl is going to execute.

[dtolnay]

I filed chyh1990/yaml-rust#87 to follow up with some documentation on the yaml-rust side.