Yaml-4.1 failed to serialize or deserialize numpy objects.

>>> import numpy as np
>>> yaml.dump(np.random.random((100,100)))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/lf2507/.local/lib/python2.7/site-packages/yaml/__init__.py", line 219, in dump
    return dump_all([data], stream, Dumper=Dumper, **kwds)
  File "/home/lf2507/.local/lib/python2.7/site-packages/yaml/__init__.py", line 198, in dump_all
    dumper.represent(data)
  File "/home/lf2507/.local/lib/python2.7/site-packages/yaml/representer.py", line 28, in represent
    node = self.represent_data(data)
  File "/home/lf2507/.local/lib/python2.7/site-packages/yaml/representer.py", line 67, in represent_data
    node = self.yaml_representers[None](self, data)
  File "/home/lf2507/.local/lib/python2.7/site-packages/yaml/representer.py", line 249, in represent_undefined
    raise RepresenterError("cannot represent an object", data)
yaml.representer.RepresenterError: ('cannot represent an object', array([[0.78867287, 0.1145689 , 0.73455115, ..., 0.03162476, 0.06458778,
        0.02051163],
       [0.0648247 , 0.44383162, 0.80787024, ..., 0.07586477, 0.47848779,
        0.05648012],
       [0.84362173, 0.31730949, 0.99826481, ..., 0.8951278 , 0.87577464,
        0.64970616],
       ...,
       [0.98758733, 0.26062501, 0.68675972, ..., 0.82339569, 0.59255629,
        0.24641607],
       [0.11395974, 0.41112024, 0.64924667, ..., 0.33038519, 0.8491808 ,
        0.87419596],
       [0.44593807, 0.15025162, 0.16101452, ..., 0.25134148, 0.30600472,
        0.38231974]]))
>>> 

[alex]

This is a deliberately change. Previously PyYAML’s default for serialization/deserialization was to use a dangerous subset of yaml that allowed handling arbitrary python objects - meaning that deserialization of untrusted input could lead to arbitrary code execution.

As a result, PyYAML 4 is now safe by default. Those wanting the previous behavior can use yaml.danger_load and yaml.danger_dump.

[alex]

Loading an object using yaml.load() in pyyaml < 4 was dangerous, yes. Now the naming reflects this.

On Tue, Jun 26, 2018 at 8:12 PM LFu [e-mail] wrote:

But then do you mean dumping a numpy object is dangerous? And if I want to serialize it I’ll have to use the yaml.danger_dump?

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/yaml/pyyaml/issues/177#issuecomment-400501913, or mute the thread https://github.com/notifications/unsubscribe-auth/AAADBB_ZKfjbin_yBFVJeyz9BZSnQM2Iks5uAs3ZgaJpZM4U42r3 .

– “I disapprove of what you say, but I will defend to the death your right to say it.” – Evelyn Beatrice Hall (summarizing Voltaire) “The people’s good is the highest law.” – Cicero GPG Key fingerprint: D1B3 ADC0 E023 8CA6