repository·main·Indexed 7 days ago
https://github.com/yaml/pyyamlA full-featured YAML processing framework for Python. It supports pure Python implementations and high-performance LibYAML bindings via CLoader and CDumper. The library provides various loading methods including safe_load(), full_load(), and unsafe_load() to handle different trust levels of input, as well as serialization tools like dump() and dump_all(). It allows for extensibility through custom constructors and representers, and provides a YAMLObject class for automated serialization.
PyYAML provides a Makefile to run various test suites.
make testmake test-pythonmake test-libyamlmake test PYTHON-VERSION=<version>Install PyYAML using the setup.py script. By default, the script checks for LibYAML and installs bindings if found. You can explicitly control LibYAML bindings using the following flags:
--with-libyaml--without-libyamlpython setup.py install
# To force LibYAML bindings:
python setup.py --with-libyaml install
# To skip LibYAML bindings:
python setup.py --without-libyaml installPyYAML provides different constructor classes with varying levels of security and capability when converting YAML nodes into Python objects:
SafeConstructor: The recommended choice for untrusted input. It only supports standard YAML tags (integers, floats, strings, sequences, maps, etc.) and does not allow the instantiation of arbitrary Python objects.FullConstructor: Inherits from SafeConstructor but adds support for some Python-specific types. It includes a blacklist to prevent certain attributes/methods from being set to mitigate security risks.UnsafeConstructor / Constructor: These allow full deserialization of arbitrary Python objects using tags like !!python/object/apply. Warning: Use these only with trusted data, as they can execute arbitrary code during deserialization.yaml.CLoader for loading and yaml.CDumper for dumping.yaml.safe_load() to prevent the execution of arbitrary code during parsing.A ScannerError may be raised when scanning quoted scalars (flow scalars) in the following scenarios:
--- or ...) is found within a quoted scalar.x, u, or U).When parsing YAML, a ScannerError may be raised during the scanning of block scalars. Common causes include:
0 is found (must be in the range 1-9).+ or -) or indentation indicators, but found an unexpected character.Errors include a start_mark and the current mark to help locate the problematic position in the YAML stream.
ConstructorError. This error typically includes information about the location of the error in the YAML stream via a mark attribute.RepresenterError is raised when the representer encounters an object it cannot serialize, such as a recursive object structure or an object that does not support the necessary reduction protocols.When scanning a URI (e.g., in a tag), a ScannerError is raised if:
% character is not followed by exactly 2 hexadecimal numbers.YAMLError to handle any exceptions raised during YAML processing. This is the base class for all errors in the library.SafeRepresenter class provides a subset of YAML tags that are safe for serialization, avoiding the execution of arbitrary Python code. It handles standard Python types like None, str, bytes, bool, int, float, list, tuple, dict, set, datetime.date, and datetime.datetime using standard YAML tags.