大约5个小时前,4.1.0
版本发布了。它破坏了我的单元测试。下面是一个干净的MVCE,显示如下:
版本3.12:
>>> import numpy as np
>>> import yaml
>>> x = np.int64(2)
>>> yaml.dump(x, Dumper=yaml.Dumper)
'!!python/object/apply:numpy.core.multiarray.scalar\n- !!python/object/apply:numpy.dtype\n args: [i8, 0, 1]\n state: !!python/tuple [3, <, null, null, null, -1, -1, 0]\n- !!binary |\n AgAAAAAAAAA=\n'
版本4.1.0
>>> import numpy as np
>>> import yaml
>>> x = np.int64(2)
>>> yaml.dump(x, Dumper=yaml.Dumper)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/foo/anaconda3/envs/bar/lib/python3.6/site-packages/yaml/__init__.py", line 217, in dump
return dump_all([data], stream, Dumper=Dumper, **kwds)
File "/foo/anaconda3/envs/bar/lib/python3.6/site-packages/yaml/__init__.py", line 196, in dump_all
dumper.represent(data)
File "/foo/anaconda3/envs/bar/lib/python3.6/site-packages/yaml/representer.py", line 26, in represent
node = self.represent_data(data)
File "/foo/anaconda3/envs/bar/lib/python3.6/site-packages/yaml/representer.py", line 57, in represent_data
node = self.yaml_representers[None](self, data)
File "/foo/anaconda3/envs/bar/lib/python3.6/site-packages/yaml/representer.py", line 229, in represent_undefined
raise RepresenterError("cannot represent an object", data)
yaml.representer.RepresenterError: ('cannot represent an object', 2)
为什么PyYAML
不再支持这些对象类型有明确的原因吗?
发布于 2018-06-27 03:47:32
在PyYAML 4.x中,dump
是safe_dump
的别名,它不会处理任意对象:
>>> yaml.dump is yaml.safe_dump
True
对旧的3.x行为使用danger_dump
。
>>> yaml.danger_dump(x)
'!!python/object/apply:numpy.core.multiarray.scalar\n- !!python/object/apply:numpy.dtype\n args: [i8, 0, 1]\n state: !!python/tuple [3, <, null, null, null, -1, -1, 0]\n- !!binary |\n AgAAAAAAAAA=\n'
load
/safe_load
也是如此。无法为4.1.0找到任何文档或发行说明,我只通过挖掘提交(这里)才能找到。
为什么PyYAML不再支持这些对象类型有明确的原因吗?
是。yaml.load
允许任意的代码执行,这样一个危险的特性应该被选择--仅限于,不可能意外地使用。可以说,从一开始就应该是这样的。
在当前的PyYAML 5.x中,可以指定加载程序/dumper类作为参数,而不是使用不同的函数:
yaml.dump(x, Dumper=yaml.Dumper) # like "danger dump"
yaml.dump(x, Dumper=yaml.SafeDumper) # like "safe_dump", won't dump python objs
与3.x一样,“危险”转储在5.x中仍然是默认的:
>>> yaml.dump(sys)
"!!python/module:sys ''\n"
>>> yaml.dump(sys, Dumper=yaml.SafeDumper)
RepresenterError: ('cannot represent an object', <module 'sys' (built-in)>)
https://stackoverflow.com/questions/51053903
复制相似问题