Closed wenheqi closed 3 years ago
Sounds good to me. Look forward to your PR.
by the way, does this change have any impact on hexo 5.3.x and before?
I just checked the homepage of js-yaml. Here is what I got:
Both safeLoad
and load
will parse string
as single YAML document. Under the load
function, the author of js-yaml
says
Use with care with untrusted sources. The same as safeLoad() but uses DEFAULT_FULL_SCHEMA by default - adds some JavaScript-specific types: !!js/function, !!js/regexp and !!js/undefined. For untrusted sources, you must additionally validate object structure to avoid injections
safeLoad
is removeda as load
is safe by default.
Speaking of trusted sources, if my understanding is correct, minos uses yaml.safeLoad
only to parse the _config.lang.yml
under minos folder and those .yml
files are supplied by the blog developer (minos provided an example _config.yml
file to make it easier to start).
I can also help to test some basics like generating static files and serve the files on a server on Hexo 5.3.x and some early versions like 3.6.0 to see if it works with yaml.load
and let you know the results on my side. Btw, do we currently have any automated test scripts available? I checked the package.json
file in minos root folder but no luck.
I was trying to use minos theme to generate a site with support for both English and Simplified Chinese.
Issue Description
An error occurred when generating the static files with Hexo 5.4.0.
How to Reproduce
_config.yml
and_config.zh-cn.yml
underthemes/minos
_config.yml
accordingly under Hexo root folderhexo new "Hello World" --lang en
hexo new "Hello World" -- lang zh-cn
hexo generate
Root Cause
As the error log indicates,
yaml.safeLoad
is remove in js-yaml 4.This issue currently should only happen on Hexo
5.4.0
since it switched to js-yaml4.0.0
. Before that, js-yaml version in the dependency was3.x.x
.How to Fix
As js-yaml suggests,
yaml.load
from4.0.0
is safe by default. I'd suggest to switch to useyaml.load
.I tested on my local machine, after switch to
yaml.load
function,hexo generate
can generate static files successfully with minos theme and no error occurred.@ppoffice I'll create a PR shortly to integrate the fix as suggested by js-yaml. Would you please help to review and see if it works for you? Thanks.