Thanks, this was interesting. But the JSON segment is a little less than terrifying as it’s predicated on the misuse of eval(), which is commonly and easily avoided. 

 
> On Dec 17, 2015, at 11:00 PM, CODE4LIB automatic digest system <[log in to unmask]> wrote:
> 
> 
> Date:    Thu, 17 Dec 2015 09:22:07 -0500
> From:    Andromeda Yelton <[log in to unmask] <mailto:[log in to unmask]>>
> Subject: yaml/xml/json, POST data, bloodcurdling terror
> 
> I strongly recommend this hilarious, terrifying PyCon talk about
> vulnerabilities in yaml, xml, and json processing:
> https://www.youtube.com/watch?v=kjZHjvrAS74 <https://www.youtube.com/watch?v=kjZHjvrAS74>
> 
> If you process user-submitted data in these formats and don't yet know why
> you should be flatly terrified, please watch this ASAP; it's illuminating.
> If you *do* know why you should be terrified, watch it anyway and giggle
> along in knowing recognition, because the talk is really very funny.
> 
> -- 
> Andromeda Yelton
> Board of Directors, Library & Information Technology Association:
> http://www.lita.org <http://www.lita.org/>
> http://andromedayelton.com <http://andromedayelton.com/>
> @ThatAndromeda <http://twitter.com/ThatAndromeda <http://twitter.com/ThatAndromeda>>