4 ms·
My YAML secret weapon is that JSON is more or less valid YAML. So, if you want YAML with a “safer syntax”, just write JSON instead. You can sprinkle in comments
by jitl 4y ago
My YAML secret weapon is that JSON is more or less valid YAML. So, if you want YAML with a “safer syntax”, just write JSON instead. You can sprinkle in comments if needed.
- pyrolistical 4y agoWith some caveats https://stackoverflow.com/a/44617419/21838 https://stackoverflow.com/a/44617419/21838
- Dylan16807 4y agoMost of which disappear with 1.2 Don't use YAML 1.1
- alexeldeib 4y agoFrom a sibling: json can’t have the header for yaml versions, so 1.2 arguably doesn’t solve this. If you force 1.2 without the header I suppose it works, but breaks compatibility?
- rurban 4y agoSo you get insecure YAML, in contrast to YAML 1.1. Don't use YAML 1.2, use the secure subset 1.1. Or even better StrictYAML
- Dylan16807 4y agoThe secure subset? I mean, things like "NO" were fixed later.
- rurban 4y agoYes, but objects, refs, tags came all in 1.2. StrictYAML got rid of all these, as all the safer YAML variants. E.g. perl5 still uses 1.0 for its cpan metadata abstraction, and still has to restrict these. I maintain the https://metacpan.org/pod/YAML::Safe https://metacpan.org/pod/YAML::Safe module, which allows whitelisting of certain objects.
- Ygg2 4y agoThere aren't many options for it. YAML spec is a huge with bunch of gotchas. E.g. C# has two listed parsers. One is 1.2 compatible and unmaintained.
- jmillikin 4y agohttps://john-millikin.com/json-is-not-a-yaml-subset https://john-millikin.com/json-is-not-a-yaml-subset
- GlitchMr 4y agoThis is an issue with Ruby's YAML implementation. YAML 1.2 processors should interpret documents without YAML directive as if they were YAML 1.2 documents - see https://yaml.org/spec/1.2.2/#681-yaml-directives https://yaml.org/spec/1.2.2/#681-yaml-directives.
- jmillikin 4y agoSee the last section -- a parser that interprets YAML as v1.2 by default will break for YAML v1.1 documents. There's no way to determine whether a `.yaml` file is YAML v1.1 or v1.2 without a version directive, and most YAML documents are v1.1 because most YAML parsers default to v1.1 semantics. I used Ruby as an example since it's easily available on most platforms, but you could also use Python or C++ or Swift or whatever language[1] you prefer. The underlying issue -- YAML not being a subset of JSON -- is universal. [1] Note that some libraries, such as go-yaml, do their own thing and don't conform to either v1.1 or v1.2 semantics.