rules:
- id: avoid-unsafe-ruamel
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    - A08:2025 - Software or Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ
    category: security
    technology:
    - ruamel.yaml
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  languages:
  - python
  message: >-
    Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can
    create arbitrary Python objects. A malicious actor could exploit
    this to run arbitrary code. Use `YAML(typ='rt')` or
    `YAML(typ='safe')` instead.
  severity: ERROR
  pattern-either:
  - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...)
  - pattern: ruamel.yaml.YAML(..., typ='base', ...)