From: Mike Harris <GENIE@...>
Date: 2006-06-15T04:52:30+09:00
Subject: Re: Using YAML as a data DSL

This is probably a non-legit example that will just show my stupidity, but:
widget_1_2_3:
  foo: <% ` frmt c:` %>

Misspelling is intentional, to provide a thin layer of safety in case 
somebody gets "curious." 

Kirk Haines wrote:

>On Wednesday 14 June 2006 11:26 am, Jatinder Singh wrote:
>
>  
>
>>YAML provides a way to persist objects in text format which is I believe
>>very user friendly, so what I thought is that a user can create a file with
>>above contents and then use YAML::load method to load above file's content
>>in to ruby object.
>>    
>>
>
>I have an application for a customer that provides them with a system to store 
>product information, photographs, inventory data, etc..., and then to search 
>all of it in a freeform way.
>
>Because different records might have different data fields which are 
>important, I gave them a simple interface.  Data is entered as a YAML hash.  
>Well, mostly, anyway.  To be fair, I am not actually using YAML to parse what 
>is entered, because I don't want to allow anything other than
>
>customer: Corona
>description: Blinky buttons with a narrow profile and embossed face.
>
>type key/value pairs.
>
>However, the inspiration came from YAML and my use of YAML for config files.  
>It's a simple enough format that they can get it right without too much 
>difficulty, and it offers flexibility.
>
>That said, if your application is going to be used by more than a small, 
>select group of people, I would be hesitant to actually use YAML in the way 
>that you suggest.  Perhaps I am overly paranoid, but I don't want to leave an 
>application open to Joe ScriptKiddie's attempts to abuse YAML into doing 
>painful things.  If I were going to go in that direction, I'd, at the very 
>least, build a preprocessor of some sort to help make sure the content loaded 
>into YAML fits the expected profile.  It would still make me nervous, though.
>
>
>Kirk Haines
>
>
>  
>