Weave Code
Yaml Laravel Package
symfony/yaml
Symfony Yaml component for parsing, loading, and dumping YAML documents in PHP. Supports reading YAML files/strings and exporting arrays/objects to YAML with configurable formatting, inline levels, and error handling. Includes comprehensive docs and Symfony integration.
Loads and dumps YAML files
Frequently asked questions about Yaml
- How do I install Symfony YAML in a Laravel project?
- Run `composer require symfony/yaml` in your Laravel project root. No additional configuration is needed for basic YAML parsing or dumping. The package integrates seamlessly with Laravel’s Composer ecosystem.
- What Laravel versions does symfony/yaml support?
- The package supports Laravel 9 (PHP 8.0+) and Laravel 10/11 (PHP 8.1+). Check your PHP version with `php -v` and ensure compatibility with your Laravel installation. No Laravel-specific dependencies exist.
- Can I use Symfony YAML for configuration files in Laravel?
- Yes, Symfony YAML is ideal for Laravel configuration files. Load YAML files with `Yaml::parseFile('path/to/config.yaml')` and dump arrays to YAML with `Yaml::dump($array, 10, 2)`. It’s widely used for `.env`-like configs or multi-environment settings.
- How do I enable the PHPStan rule for unsafe YAML deserialization?
- First, ensure PHPStan 1.12+ is installed (`composer require --dev phpstan/phpstan`). Then add the rule to your `phpstan.neon`: `includes: - vendor/symfony/yaml/PHPStan/UnsafeUnserialize.neon`. Run `phpstan analyse` to detect unsafe YAML tags like `!!php/object`.
- What are the risks of using custom YAML tags like `!!php/object`?
- Custom tags like `!!php/object` can trigger unsafe deserialization, leading to security vulnerabilities (e.g., remote code execution). Symfony YAML now includes a PHPStan rule to flag these risks. Disable them at parse time with `Yaml::parse($yaml, [], 10, null, true)` for stricter security.
- Does symfony/yaml work with Laravel’s validation system?
- Yes, you can extend Laravel’s validation with a custom rule to block unsafe YAML. Create a rule like `YamlUnsafeTagRule` that checks for `!!php/` tags and integrate it into your validator. Example: `Validator::make(['yaml' => $content], ['yaml' => ['unsafe_yaml']]).`
- How do I whitelist trusted YAML files in PHPStan?
- Add exclusions to your `phpstan.neon` under `arguments.paths` to ignore trusted files. Example: `paths: - config/ - '!config/untrusted.yaml'`. This prevents false positives for files you explicitly trust, like vendor-provided configs.
- Are there performance impacts from using Symfony YAML in Laravel?
- Symfony YAML is optimized for performance with minimal overhead. The PHPStan rule adds analysis time during testing but has no runtime impact. For production, parsing/dumping YAML is fast and memory-efficient, even for large files.
- What alternatives exist for YAML parsing in Laravel?
- Alternatives include `spatie/array-to-yaml` (simpler but less feature-rich) or `symfony/serializer` (for broader serialization needs). Symfony YAML is preferred for its robustness, Symfony integration, and security features like the PHPStan rule.
- How do I test YAML parsing in Laravel with Pest or PHPUnit?
- Use Pest or PHPUnit to assert YAML parsing/dumping. Example: `Yaml::parse($yamlString) === $expectedArray`. For security testing, add a Pest test to fail on unsafe YAML: `expect(Yaml::parse($yaml))->not->toContain('!!php/');`. Combine with the PHPStan rule for CI enforcement.
Weaver
How can I help you explore Laravel packages today?