4 ms·
With some caveats https://stackoverflow.com/a/44617419/21838 https://stackoverflow.com/a/44617419/21838
by pyrolistical 4y ago
With some caveats https://stackoverflow.com/a/44617419/21838 https://stackoverflow.com/a/44617419/21838
- Dylan16807 4y agoMost of which disappear with 1.2 Don't use YAML 1.1
- alexeldeib 4y agoFrom a sibling: json can’t have the header for yaml versions, so 1.2 arguably doesn’t solve this. If you force 1.2 without the header I suppose it works, but breaks compatibility?
- rurban 4y agoSo you get insecure YAML, in contrast to YAML 1.1. Don't use YAML 1.2, use the secure subset 1.1. Or even better StrictYAML
- Dylan16807 4y agoThe secure subset? I mean, things like "NO" were fixed later.
- rurban 4y agoYes, but objects, refs, tags came all in 1.2. StrictYAML got rid of all these, as all the safer YAML variants. E.g. perl5 still uses 1.0 for its cpan metadata abstraction, and still has to restrict these. I maintain the https://metacpan.org/pod/YAML::Safe https://metacpan.org/pod/YAML::Safe module, which allows whitelisting of certain objects.
- Ygg2 4y agoThere aren't many options for it. YAML spec is a huge with bunch of gotchas. E.g. C# has two listed parsers. One is 1.2 compatible and unmaintained.