{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/1004","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/1004/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/1004/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/1004/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/1004","id":40947845,"number":1004,"title":"Consider not handling YAML in APIserver","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/api/cluster","name":"api/cluster","color":"e1ed21"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/app-config-deployment","name":"area/app-config-deployment","color":"fb6420"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/area/usability","name":"area/usability","color":"00cc00"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/component/CLI","name":"component/CLI","color":"0052cc"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/component/client","name":"component/client","color":"0052cc"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P2","name":"priority/P2","color":"fbca04"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/status/help-wanted","name":"status/help-wanted","color":"159818"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/master","name":"team/master","color":"d2b48c"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/UX","name":"team/UX","color":"d2b48c"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/6","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/milestones/v1.0","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/6/labels","id":969317,"number":6,"title":"v1.0","description":"Issues that need to be resolved for v1.0 of Kubernetes.","creator":{"login":"goltermann","id":9358478,"avatar_url":"https://avatars.githubusercontent.com/u/9358478?v=3","gravatar_id":"","url":"https://api.github.com/users/goltermann","html_url":"https://github.com/goltermann","followers_url":"https://api.github.com/users/goltermann/followers","following_url":"https://api.github.com/users/goltermann/following{/other_user}","gists_url":"https://api.github.com/users/goltermann/gists{/gist_id}","starred_url":"https://api.github.com/users/goltermann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/goltermann/subscriptions","organizations_url":"https://api.github.com/users/goltermann/orgs","repos_url":"https://api.github.com/users/goltermann/repos","events_url":"https://api.github.com/users/goltermann/events{/privacy}","received_events_url":"https://api.github.com/users/goltermann/received_events","type":"User","site_admin":false},"open_issues":114,"closed_issues":84,"state":"open","created_at":"2015-02-06T20:27:16Z","updated_at":"2015-03-23T19:54:45Z","due_on":null,"closed_at":null},"comments":36,"created_at":"2014-08-22T20:36:29Z","updated_at":"2015-03-23T20:09:31Z","closed_at":"2015-03-23T19:54:45Z","body":"The APIserver processes JSON and YAML.\r\nA vulnerability in the apiserver would be critical.\r\n\r\nCompared to JSON:\r\n- YAML has a crazy complicated SPEC.\r\n- YAML has a go implementation that is more complex \r\n  - 14KLOC JSON vs 30KLOC YAML\r\n- YAML has fewer tests in the go implementation\r\n  - 8KLOC JSON vs 2.5KLOC YAML\r\n- Has a track record of vulnerabilities \r\n   - YAML has fewer vulnerabilities, but this may be due to its less widespread use in critical software\r\n   - 24 CVEs match YAML vs 66 JSON, using http://web.nvd.nist.gov/view/vuln/search\r\n\r\nTherefore we should consider one of the following changes:\r\n 1. Do not process YAML in the apiserver itself:\r\n  1. Convert YAML to JSON in clients \r\n  1. Recommend that users needing to use YAML via `curl`, etc, can pipe YAML through simple yaml to json converter tool.\r\n 1. Convert YAML to JSON in a less privileged proxy process (which does not have access to etcd).\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/85172144","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/1004#issuecomment-85172144","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/1004","id":85172144,"user":{"login":"bgrant0607","id":7725777,"avatar_url":"https://avatars.githubusercontent.com/u/7725777?v=3","gravatar_id":"","url":"https://api.github.com/users/bgrant0607","html_url":"https://github.com/bgrant0607","followers_url":"https://api.github.com/users/bgrant0607/followers","following_url":"https://api.github.com/users/bgrant0607/following{/other_user}","gists_url":"https://api.github.com/users/bgrant0607/gists{/gist_id}","starred_url":"https://api.github.com/users/bgrant0607/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgrant0607/subscriptions","organizations_url":"https://api.github.com/users/bgrant0607/orgs","repos_url":"https://api.github.com/users/bgrant0607/repos","events_url":"https://api.github.com/users/bgrant0607/events{/privacy}","received_events_url":"https://api.github.com/users/bgrant0607/received_events","type":"User","site_admin":false},"created_at":"2015-03-23T20:09:31Z","updated_at":"2015-03-23T20:09:31Z","body":"Is the content-type issue (setting in the client and documenting via go-restful) addressed by #5763?"}}