full_load() method shows inconsistent behavior when handling YAML tags.

[coco1629]

When the !!str tag is used alone, the parser can process it normally and returns an empty string. But when !!str is followed by the sequence terminator ], YAML incorrectly interprets ] as part of the tag name rather than as the end symbol of the sequence and throws ParserError.

poc

test1 = "!!seq [!!bool true, !!str ]"
ret = yaml.full_load(test1)
print("test1:" + str(ret))
test2 = "!!str"
ret = yaml.full_load(test2)
print("test2:" + ret)
test3 = "!!seq [!!bool true, !!str]"
ret = yaml.full_load(test3)
print(ret)

trace

test1:[True, '']
test2:
Traceback (most recent call last):
  File "/root/PyRTFuzz/apispec/PySpec/seeds_yaml3_1.0/yaml.full_load/1#yaml#full_load#10.py", line 40, in <module>
    RunFuzzer('x')
  File "/root/PyRTFuzz/apispec/PySpec/seeds_yaml3_1.0/yaml.full_load/1#yaml#full_load#10.py", line 37, in RunFuzzer
    output = dc.demoFunc(x)
  File "/root/PyRTFuzz/apispec/PySpec/seeds_yaml3_1.0/yaml.full_load/1#yaml#full_load#10.py", line 28, in demoFunc
    ret = yaml.full_load(test3)
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/__init__.py", line 105, in full_load
    return load(stream, FullLoader)
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/__init__.py", line 81, in load
    return loader.get_single_data()
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/constructor.py", line 49, in get_single_data
    node = self.get_single_node()
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/composer.py", line 36, in get_single_node
    document = self.compose_document()
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/composer.py", line 55, in compose_document
    node = self.compose_node(None, None)
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/composer.py", line 82, in compose_node
    node = self.compose_sequence_node(anchor)
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/composer.py", line 110, in compose_sequence_node
    while not self.check_event(SequenceEndEvent):
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/parser.py", line 98, in check_event
    self.current_event = self.state()
  File "/root/anaconda3/lib/python3.9/site-packages/yaml/parser.py", line 483, in parse_flow_sequence_entry
    raise ParserError("while parsing a flow sequence", self.marks[-1],
yaml.parser.ParserError: while parsing a flow sequence
  in "<unicode string>", line 1, column 7:
    !!seq [!!bool true, !!str]
          ^
expected ',' or ']', but got '<stream end>'
  in "<unicode string>", line 1, column 27:
    !!seq [!!bool true, !!str] 

Expected behavior: !!str should behave consistently , it can be successfully parsed as an empty string '' within [].

[perlpunk]

The problem lies in the YAML 1.1 specification (PyYAML implements 1.1). It allows flow indicators []{}, to be part of tags:
https://yaml.org/spec/1.1/#ns-tag-char

[43]	ns-uri-char	::=	  [ns-word-char] | “%” [ns-hex-digit] [ns-hex-digit]
                        | “;” | “/” | “?” | “:” | “@” | “&” | “=” | “+” | “$” | “,”
                        | “_” | “.” | “!” | “~” | “*” | “'” | “(” | “)” | “[” | “]”

[44]	ns-tag-char	::=	ns-uri-char - “!”

while YAML 1.2 excludes flow indicators::
https://yaml.org/spec/1.2.2/#rule-ns-tag-char

[40] ns-tag-char ::=
    [ns-uri-char]
  - [c-tag]               # '!'
  - [c-flow-indicator]

Excluding those characters would be backwards incompatible and could break things, so it has to be weighed against the benefits.

[coco1629]

The problem lies in the YAML 1.1 specification (PyYAML implements 1.1). It allows flow indicators []{}, to be part of tags: https://yaml.org/spec/1.1/#ns-tag-char

[43]	ns-uri-char	::=	  [ns-word-char] | “%” [ns-hex-digit] [ns-hex-digit]
                        | “;” | “/” | “?” | “:” | “@” | “&” | “=” | “+” | “$” | “,”
                        | “_” | “.” | “!” | “~” | “*” | “'” | “(” | “)” | “[” | “]”

[44]	ns-tag-char	::=	ns-uri-char - “!”

while YAML 1.2 excludes flow indicators:: https://yaml.org/spec/1.2.2/#rule-ns-tag-char

[40] ns-tag-char ::=
    [ns-uri-char]
  - [c-tag]               # '!'
  - [c-flow-indicator]

Excluding those characters would be backwards incompatible and could break things, so it has to be weighed against the benefits.

Thanks for your reply. But I checked the documents content you provided, I found that { }are not listed in ns-uri-char — did I miss something? It seems that { } are not valid; only their encoded forms %7B/%7D are permitted?
And when I tried inputting !!map {!!bool true, !!str}, a similar error occurred.

[43]	ns-uri-char	::=	  [ns-word-char] | “%” [ns-hex-digit] [ns-hex-digit]
                        | “;” | “/” | “?” | “:” | “@” | “&” | “=” | “+” | “$” | “,”
                        | “_” | “.” | “!” | “~” | “*” | “'” | “(” | “)” | “[” | “]”           <- no { }

[44]	ns-tag-char	::=	ns-uri-char - “!”

[perlpunk]

Sorry, yes, the curly braces were not allowed in 1.1.