Don't load arbitrary objects.

[startling]

snakeyaml allows the creation of arbitrary Java objects. This is usually a Bad Thing. These commits add an option key to make-yaml, :unsafe, and uses SafeConstructor by default.

(See also #10).

[espeed]

👍 to using the SafeConstructor

https://code.google.com/p/snakeyaml/source/browse/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java

https://code.google.com/p/snakeyaml/source/browse/src/test/java/examples/SafeConstructorExampleTest.java

See http://blogs.teamb.com/craigstuntz/2013/02/04/38738/

[startling]

Glad you like it!

For what it's worth, this library is apparently unmaintained; we've forked it and applied our fixes and some other changes at circleci/clj-yaml.

[espeed]

@startling thanks for heads up!