News for hackers. Stuff that matters.
Re:I accidentally used YAML.parse instead of JSON.parse and ... by mdaniel on Sunday January 23, 2022 @09:07PM (#30052843)
Tested on python what? I was curious to see what error that produced, figuring it would be some whitespace due to the difference between the list items, but using the yamlized python that I had lying around, it did the sane thing:

    PATH=$HOMEBREW_PREFIX/opt/ansible/libexec/bin:$PATH
    pip list | grep -i yaml
    python -V
    python <<'DOIT'
    from io import StringIO
    import yaml
    print(yaml.safe_load(StringIO(
    '''
        {
            "list": [
                {},
                    {}
            ]
        }
    ''')))
    DOIT
produces

    PyYAML                6.0
    Python 3.10.1
    {'list': [{}, {}]}
Re:I accidentally used YAML.parse instead of JSON.parse and ... by hoherd on Monday January 24, 2022 @12:17AM (#30053975)
With leading tabs it does not work.

  $ sed 's/\t/--->/g' break-yaml.json
  --->{
  --->--->"list": [
  --->--->--->{},
  --->--->--->{}
  --->--->]
  --->}
  $ jq -c . break-yaml.json
  {"list":[{},{}]}
  $ yaml-to-json.py break-yaml.json
  ERROR: break-yaml.json could not be parsed
  while scanning for the next token
  found character '\t' that cannot start any token
    in "break-yaml.json", line 1, column 1
  $ sed 's/\t/    /g' break-yaml.json | yaml-to-json.py
  {"list": [{}, {}]}
Re:I accidentally used YAML.parse instead of JSON.parse and ... by ingy on Monday January 24, 2022 @02:23PM (#30062570)
This is completely valid YAML.

YAML does not allow tabs in indentation, but the tabs in your example are not indentation according to the YAML spec productions.

You can see it clearly here against many YAML parsers: https://play.yaml.io/main/parser?input=CXsKCQkibGlzdCI6IFsKC...

As tinita points out, sadly PyYAML and libyaml implement this wrong.

See https://matrix.yaml.info/

Re:I accidentally used YAML.parse instead of JSON.parse and ... by tinita on Monday January 24, 2022 @01:24PM (#30061685)
That's because PyYAML doesn't implement the spec correctly.
Re:I accidentally used YAML.parse instead of JSON.parse and ... by MrPatan on Monday January 24, 2022 @03:31AM (#30054868)
Tabs are not valid JSON
Re:I accidentally used YAML.parse instead of JSON.parse and ... by zimpenfish on Monday January 24, 2022 @03:44AM (#30054952)
Do you have a link for that?

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... says:

> Insignificant whitespace may be present anywhere except within a JSONNumber [forbidden] or JSONString [interpreted as part of the string]

And specifically lists tab as whitespace:

> The tab character (U+0009), carriage return (U+000D), line feed (U+000A), and space (U+0020) characters are the only valid whitespace characters.

More specifically, expanding https://datatracker.ietf.org/doc/html/rfc8259#section-2 gives an array as (roughly)

> ws %x5B ws value (ws %x2C ws value)* ws %x5D ws

Where `ws` explicitly includes `%x09`. Which seems to cover this case?

Re:I accidentally used YAML.parse instead of JSON.parse and ... by tonyg on Monday January 24, 2022 @04:23AM (#30055198)
Per RFC 8259:

      ws = *(
              %x20 /              ; Space
              %x09 /              ; Horizontal tab
              %x0A /              ; Line feed or New line
              %x0D )              ; Carriage return
Re:I accidentally used YAML.parse instead of JSON.parse and ... by Someone on Monday January 24, 2022 @04:15AM (#30055129)
The grammar in https://www.json.org/json-en.html disagrees. It has

  json
    element

  element
    ws value ws

  ws
    ‘0009’ ws
Re:I accidentally used YAML.parse instead of JSON.parse and ... by remram on Sunday January 23, 2022 @09:46PM (#30053121)
Edited with string escapes, the tab didn't make it through HN.

The error from PyYaml 5.3.1:

    yaml.scanner.ScannerError: while scanning for the next token
    found character '\t' that cannot start any token
      in "<unicode string>", line 4, column 1
Re:I accidentally used YAML.parse instead of JSON.parse and ... by notreallyserio on Sunday January 23, 2022 @10:45PM (#30053491)
If it continues to be hard to share, I suggest encoding it as a base64 string so folks can decode it into a file with exactly the right contents.
Re:I accidentally used YAML.parse instead of JSON.parse and ... by CameronNemo on Sunday January 23, 2022 @10:58PM (#30053578)
This is, unwittingly, the most YAML-relevant comment in this thread.
Re:I accidentally used YAML.parse instead of JSON.parse and ... by jwilk on Monday January 24, 2022 @09:17AM (#30057807)
Not base64, but this should be easy to reproduce:

  $ printf '{\n\t"list": [\n\t\t{},\n\t\t{}\n\t]\n}\n' > test.json

  $ jq < test.json 
  {
    "list": [
      {},
      {}
    ]
  }

  $ yamllint test.json 
  test.json
    2:1       error    syntax error: found character '\t' that cannot start any token (syntax)
Re:I accidentally used YAML.parse instead of JSON.parse and ... by ak217 on Monday January 24, 2022 @12:34PM (#30060935)
Thanks, I'm finally able to reproduce this.

It would be great if instead of the histrionic message on CPAN (which amusingly accuses others of "mass hysteria"), the author would just say "YAML documents can't start with a tab while JSON documents can, making JSON not a strict subset of YAML".

The YAML spec should be updated to reflect this, but I wonder if a simple practical workaround in YAML parsers (like replacing each tab at the beginning of the document with two spaces before feeding it to the tokenizer) would be sufficient in the short term.

Re:I accidentally used YAML.parse instead of JSON.parse and ... by ingy on Monday January 24, 2022 @02:42PM (#30062858)
> "YAML documents can't start with a tab while JSON documents can, making JSON not a strict subset of YAML"

But YAML can start with tabs. Tabs are allowed as separating whitespace in most of the spec productions but are not allowed as indentation. Even though those tabs look like indentation, the spec productions don't interpret them as such.

See my comment above and esp see https://play.yaml.io/main/parser?input=CXsKCQkibGlzdCI6IFsKC...

Note: the YAML spec maintainers (I am one) have identified many issues with YAML which we are actively working on, but (somewhat surprisingly) we have yet to find a case where valid JSON is invalid YAML 1.2.

Re:I accidentally used YAML.parse instead of JSON.parse and ... by ak217 on Monday January 24, 2022 @04:11PM (#30064106)
Thanks for the clarification. Let's fix it in PyYAML then :)

Speaking of PyYAML, I recently ran into an issue where I had to heavily patch PyYAML to prevent its parse result from being susceptible to entity expansion attacks. It would be nice to at least have a PyYAML mode to completely ignore anchors and aliases (as well as tags) using simple keyword arguments. Protection against entity expansion abuse would be nice too.