-
-
Notifications
You must be signed in to change notification settings - Fork 119
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
improve ISO8601 support #578
Conversation
02e0009
to
5f7c04e
Compare
This one's tricky, because for YAML 1.1 Could it be that you're attempting to parse serialized timestamps without overriding the YAML version from its default of 1.2, which does not support Separately, there does seem to be a bug to fix in the timestamp serialiser, as this ought to include an explicit tag: > YAML.stringify(new Date(), { customTags: ["timestamp"] })
'2024-10-02T11:22:59.726Z\n' This does work for other custom tags, such as: > YAML.stringify(new Set(), { customTags: ["set"] })
'!!set {}\n' |
Thanks @eemeli, I missed this page about the timestamp definition. It was exactly the one I was searching for but could not put my hands on! Then the RegExp currently in use is more broad than the one officially supported but even so does not support the output format of
What would like me to do? I see 3 possible things:
The problem with |
Buggy example just for the sake of being complete and well understood: const yaml = require("yaml");
const res = yaml.parse(
yaml.stringify(
{ date: new Date("2024-04-01T02:00:00Z") },
{ customTags: ["timestamp"] }
),
{ customTags: ["timestamp"] }
);
console.log(res.date, res.date instanceof Date)
// 2024-04-01T02:00 false |
Ok, so a couple of things are wrong here:
I think the test regexp should not be changed, as that's liable to be a breaking change either way, and the deviations aren't too bad. The second-stripping during serialization should be dropped. The |
I mostly agree about everything you just said. The only thing I wonder is about the test RegExp. I think it could be expanded to support everything that the official doc supports but keep support of the small things it parses that are not in spec (if they are any). The idea would be to be at least compliant. It would not be too complicated no? Maybe it's already the case. Hard to compare them… |
As far as I can tell, the only features that the current test regexp does not support and the one in the spec does are:
Both of those look like mistakes in the original spec, tbh. I'd be happy to consider adding support for them if there's a real-world case that is impacted, but that seems unlikely. |
I think you are right. Looking at the codebase, it seems to me that custom tags use I propose to change this MR to fix Once that is merged, we can do another one to tackle I think you are correct about the currect regexp. |
There's an existing pattern used here that should probably work for this use case as well: yaml/src/compose/compose-scalar.ts Lines 75 to 77 in 5adbb60
|
5f7c04e
to
4e23435
Compare
4e23435
to
35dfead
Compare
@eemeli I just updated this MR with the fix for |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry for the delay in getting to this, but this does look like the right fix!
 <h3>Snyk has created this PR to upgrade yaml from 2.6.1 to 2.7.0.</h3> :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project. <hr/> - The recommended version is **1 version** ahead of your current version. - The recommended version was released **2 months ago**. <details> <summary><b>Release notes</b></summary> <br/> <details> <summary>Package name: <b>yaml</b></summary> <ul> <li> <b>2.7.0</b> - <a href="https://redirect.github.com/eemeli/yaml/releases/tag/v2.7.0">2024-12-31</a></br><p>The library is now available on JSR as <a href="https://jsr.io/@ eemeli/yaml" rel="nofollow">@ eemeli/yaml</a> and on deno.land/x as <a href="https://deno.land/x/yaml" rel="nofollow">yaml</a>. In addition to Node.js and browsers, it should work in Deno, Bun, and Cloudflare Workers.</p> <ul> <li>Use .ts extension in all relative imports (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2704495320" data-permission-text="Title is private" data-url="eemeli/yaml#591" data-hovercard-type="pull_request" data-hovercard-url="/eemeli/yaml/pull/591/hovercard" href="https://redirect.github.com/eemeli/yaml/pull/591">#591</a>)</li> <li>Ignore newline after block seq indicator as space before value (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2684051086" data-permission-text="Title is private" data-url="eemeli/yaml#590" data-hovercard-type="issue" data-hovercard-url="/eemeli/yaml/issues/590/hovercard" href="https://redirect.github.com/eemeli/yaml/issues/590">#590</a>)</li> <li>Require Node.js 14.18 or later (was 14.6) (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2765423835" data-permission-text="Title is private" data-url="eemeli/yaml#598" data-hovercard-type="issue" data-hovercard-url="/eemeli/yaml/issues/598/hovercard" href="https://redirect.github.com/eemeli/yaml/issues/598">#598</a>)</li> </ul> </li> <li> <b>2.6.1</b> - <a href="https://redirect.github.com/eemeli/yaml/releases/tag/v2.6.1">2024-11-19</a></br><ul> <li>Do not strip <code>:00</code> seconds from <code>!!timestamp</code> values (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2561052215" data-permission-text="Title is private" data-url="eemeli/yaml#578" data-hovercard-type="pull_request" data-hovercard-url="/eemeli/yaml/pull/578/hovercard" href="https://redirect.github.com/eemeli/yaml/pull/578">#578</a>, with thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/qraynaud/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/qraynaud">@ qraynaud</a>)</li> <li>Tighten regexp for JSON <code>!!bool</code> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2651384053" data-permission-text="Title is private" data-url="eemeli/yaml#587" data-hovercard-type="pull_request" data-hovercard-url="/eemeli/yaml/pull/587/hovercard" href="https://redirect.github.com/eemeli/yaml/pull/587">#587</a>, with thanks to <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/vra5107/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/vra5107">@ vra5107</a>)</li> <li>Default to literal block scalar if folded would overflow (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2594165845" data-permission-text="Title is private" data-url="eemeli/yaml#585" data-hovercard-type="issue" data-hovercard-url="/eemeli/yaml/issues/585/hovercard" href="https://redirect.github.com/eemeli/yaml/issues/585">#585</a>)</li> </ul> </li> </ul> from <a href="https://redirect.github.com/eemeli/yaml/releases">yaml GitHub release notes</a> </details> </details> --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._ **For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiIzYjkwN2M1MC0zODJkLTQyMjQtYTFhZC02OGFmODhhNWY3MTMiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjNiOTA3YzUwLTM4MmQtNDIyNC1hMWFkLTY4YWY4OGE1ZjcxMyJ9fQ==" width="0" height="0"/> > - 🧐 [View latest project report](https://app.snyk.io/org/blankll/project/9c72c875-e7a2-4e68-85a9-7b26a5bc5b32?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template) > - 🛠 [Adjust upgrade PR settings](https://app.snyk.io/org/blankll/project/9c72c875-e7a2-4e68-85a9-7b26a5bc5b32/settings/integration?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.snyk.io/org/blankll/project/9c72c875-e7a2-4e68-85a9-7b26a5bc5b32/settings/integration?pkg=yaml&utm_source=github&utm_medium=referral&page=upgrade-pr#auto-dep-upgrades) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"yaml","from":"2.6.1","to":"2.7.0"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"3b907c50-382d-4224-a1ad-68af88a5f713","prPublicId":"3b907c50-382d-4224-a1ad-68af88a5f713","packageManager":"npm","priorityScoreList":[],"projectPublicId":"9c72c875-e7a2-4e68-85a9-7b26a5bc5b32","projectUrl":"https://app.snyk.io/org/blankll/project/9c72c875-e7a2-4e68-85a9-7b26a5bc5b32?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2024-12-31T04:40:47.460Z"},"vulns":[]}' Co-authored-by: snyk-bot <snyk-bot@snyk.io>
Hello!
I created a script doing DB dumps in YAML and doing that I manipulated dates extensively. I noticed that in a rare case,
yaml.stringify
could produce a validISO8601
date that would not be parsed as a Date byyaml.parse()
. This made me decide to improve the RegExp used byyaml
so that it supports at least the formats it can output. But since I was tinkling with those, I improved ISO8601 support overall.The case that could not work: when a date had no seconds nor milliseconds, it was trimmed by this function:
Which resulted in valid dates like:
2024-10-02T09:00
. Sadly, once in.parse(value, { customTags: ["timestamp"] })
provide a value of"2024-10-02T09:00"
instead of the expected Date instance.I also added support for:
-
characters:
charactersNote: though
20241002
is a valid ISO8601 date,yaml.parse()
still gives priority to the number type abovetimestamp
. Though both are testingtrue
. Could that become an issue? The YAML spec is not very explicit about what timestamp formats should be allowed and how they should be disambiguated.