safe_yaml

> As Stormbrew already pointed out, we already have a format that is ideal for configurations (and sure, data exchange, why not), and it is called yaml. Unfortunately YAML for untrusted input and data exchange is unsafe by default, depending on the language and implementation. A flag might need to be set, or extra modules included like SafeYAML[1] to keep Yaml from instantiating arbitrary objects. [1] https://github.com/dtao/safe_yaml

Assuming you and your parent are both coyly referring to the recent YAML parsing related Ruby and Rails vulnerabilities, I think the analogy is better than you realize. Raw strcat is to the built-in YAML parser as strncat is to the various whitelist-based YAML fixes[1]. Both strcat and the YAML parser work as intended, but should never be exposed to data controlled by an external source. Buffer overflows aren't intentional, but uses of strcat are, even when they are wrong. 1. https://github.com/dtao/safe_yaml

I suggest Rails people have a look at safe_yaml which (now) replaces YAML.load by a safe (safer?) version: https://github.com/dtao/safe_yaml (nb: I've enable it on apps without issues)

This is currently being discussed on https://github.com/tenderlove/psych/issues/119 There is also https://github.com/dtao/safe_yaml (hat tip @patio11, who also points out that this has not been audited for completeness/correctness)