title: Why does PyYAML 5.1 raise YAMLLoadWarning when the default loader has been made safer already?
body: <p>Here is my code:</p>
  
  <pre><code>import yaml
  yaml.load('foo')
  </code></pre>
  
  <p>This code leads to the following warning with PyYAML (5.1).</p>
  
  <pre><code>$ pip install pyyaml
  $ python3 foo.py
  foo.py:2: YAMLLoadWarning: calling yaml.load() without Loader=... is deprecated, as the default Loader is unsafe. Please read https://msg.pyyaml.org/load for full details.
    yaml.load('foo')
  </code></pre>
  
  <p>So I visited <a href="https://msg.pyyaml.org/load" rel="noreferrer">https://msg.pyyaml.org/load</a> to see what this is about but I do not understand the need for this warning.</p>
  
  <p>First, the documentation says,</p>
  
  <blockquote>
    <p><code>UnsafeLoader</code> (also called <code>Loader</code> for backwards compatability)</p>
    
    <p>The original Loader code that could be easily exploitable by untrusted data input.</p>
  </blockquote>
  
  <p>Okay, that makes sense. In an earlier version, the original loader was unsafe. Further, it says,</p>
  
  <blockquote>
    <p><code>FullLoader</code></p>
    
    <p>Loads the full YAML language. Avoids arbitrary code execution. This is currently (PyYAML 5.1) the default loader called by <code>yaml.load(input)</code> (after issuing the warning).</p>
  </blockquote>
  
  <p>So the current version uses <code>FullLoader</code> which is not unsafe. This is confirmed again in the document.</p>
  
  <blockquote>
    <p>The load function was also made <strong>much</strong> safer by disallowing the execution of arbitrary functions by the default loader (<code>FullLoader</code>).</p>
  </blockquote>
  
  <p>If the current version that uses <code>FullLoader</code> is not unsafe, then why do we need the <code>YAMLLoadWarning</code> at all?</p>