ruby / psych

A libyaml wrapper for Ruby
MIT License
566 stars 206 forks source link

Alias names are too permissive in SnakeYAML-Engine #689

Open headius opened 1 month ago

headius commented 1 month ago

See original issue at jruby/jruby#8352.

The following YAML fails to parse in SnakeYAML-Engine, used by the JRuby Psych extension:

--- &1 !ruby/object:Set
hash:
  :one: true
  :two: true
  *1: true

This is due to a bug in SnakeYAML-Engine reported here: https://bitbucket.org/snakeyaml/snakeyaml-engine/issues/54/do-not-allow-colon-to-be-a-part-of-an

This will be fixed shortly in an upcoming release of SnakeYAML-Engine. Psych will need to be updated to the new version and released.

perlpunk commented 1 month ago

The proper fix is to add a space after the alias:

  *1 : true

It's valid to have a colon in anchor names (and yes, I agree that it should have been forbidden, but it isn't).

headius commented 3 weeks ago

@asomov This is the Psych bug for the recent alias issue in SnakeYAML. Let us know if that fix is coming soon. Thank you!

asomov commented 3 weeks ago

@headius finally: https://bitbucket.org/snakeyaml/snakeyaml-engine/issues/54/insert-a-trailing-space-when-an-alias-is-a

headius commented 3 weeks ago

@asomov Is that ready for testing on my end?

asomov commented 3 weeks ago

@headius you can try the latest 2.9-SNAPSHOT

https://oss.sonatype.org/content/repositories/snapshots/org/snakeyaml/snakeyaml-engine/2.9-SNAPSHOT/

headius commented 3 weeks ago

@asomov Success! Combining your snapshot jar with my other fix jruby/jruby#8394, I can run the example from jruby/jruby#8352.

asomov commented 3 weeks ago

@headius Great! Do you need an urgent release?

headius commented 3 weeks ago

@asomov I don't know how much of an issue this is for @mcorino.

Releasing for us would be the psych gem first and then adding that to the JRuby release, but with our next JRuby release a week away it's too close. So whenever you can release is fine for us, and I can update the gem the same day.

mcorino commented 3 weeks ago

@headius @asomov Fine by me.

asomov commented 3 weeks ago

@headius @mcorino please ping me in advance (a week) to release when you need it (I will wait for other possible changes)

mcorino commented 3 weeks ago

@asomov @headius The issue is currently not blocking for me (I would like it fixed) so any time you get to it is fine by me.