XML から YAML への変換

import { XMLParser } from 'fast-xml-parser';
import yaml from 'js-yaml';

const parser = new XMLParser({
  ignoreAttributes: false,
  attributeNamePrefix: 'attr_',   // not @_: YAML reserves a leading @
  textNodeName: 'text',           // not #text: a leading # is a comment
  parseTagValue: false,           // keep values as strings
  parseAttributeValue: false,
  processEntities: false,         // do not expand DOCTYPE-declared entities
  isArray: (name) => ['line', 'item', 'entry'].includes(name),
});

const out = yaml.dump(parser.parse(xmlSource), {
  lineWidth: -1,     // never fold long lines; folding rewrites your data
  noRefs: true,      // never emit anchors and aliases
  quotingType: "'",
  sortKeys: false,
});

// js-yaml's dumper is conservative: it quotes NO, 01730, 1.10, 22:22 and
// 0x1F on its own, and quotes keys that begin with @ or #. Add
// forceQuotes: true if you want every string quoted regardless.

import xmltodict
import yaml

doc = xmltodict.parse(
    xml_source,
    disable_entities=True,          # blocks the expat entity attacks
    attr_prefix='attr_',
    cdata_key='text',
    force_list=('line', 'item', 'entry'),
)

print(yaml.safe_dump(
    doc,
    default_flow_style=False,
    allow_unicode=True,
    sort_keys=False,
    width=10 ** 9,                  # effectively disable line folding
))

# PyYAML implements the YAML 1.1 resolver, so its dumper knows that NO,
# 01730 and 1.10 would load back as a bool, an int and a float, and quotes
# them. Use safe_dump, never dump: the full dumper emits Python-specific
# tags that only yaml.unsafe_load can read back.

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.dataformat.xml.XmlFactory;
import com.fasterxml.jackson.dataformat.xml.XmlMapper;
import com.fasterxml.jackson.dataformat.yaml.YAMLGenerator;
import com.fasterxml.jackson.dataformat.yaml.YAMLMapper;
import javax.xml.stream.XMLInputFactory;

XMLInputFactory input = XMLInputFactory.newFactory();
input.setProperty(XMLInputFactory.SUPPORT_DTD, false);
input.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);

JsonNode tree = new XmlMapper(new XmlFactory(input)).readTree(xmlSource);

YAMLMapper yaml = YAMLMapper.builder()
    .disable(YAMLGenerator.Feature.WRITE_DOC_START_MARKER)
    .disable(YAMLGenerator.Feature.MINIMIZE_QUOTES)   // off is the safe state
    .enable(YAMLGenerator.Feature.LITERAL_BLOCK_STYLE)
    .build();

String out = yaml.writeValueAsString(tree);

// MINIMIZE_QUOTES is the setting to leave alone. It is off by default, and
// turning it on is how a value of NO ends up unquoted in a Jackson-generated
// file that a Python service then reads as false.

using System.Xml;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
using YamlDotNet.Core;
using YamlDotNet.Serialization;

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null,
    MaxCharactersFromEntities = 1024 * 1024,
};

using var reader = XmlReader.Create(new StringReader(xmlSource), settings);
var document = new XmlDocument { XmlResolver = null };
document.Load(reader);

string json = JsonConvert.SerializeXmlNode(document);
object? tree = JsonConvert.DeserializeObject<JObject>(json)?.ToObject<object>();

var serialiser = new SerializerBuilder()
    .WithDefaultScalarStyle(ScalarStyle.SingleQuoted)   // quote everything
    .Build();

Console.Write(serialiser.Serialize(tree));

// WithDefaultScalarStyle is blunt: every scalar comes out quoted, including
// the ones that did not need it. That is the right trade for generated data.
// Drop it only if you are hand-checking the output.

# yq v4 (Mike Farah) converts directly and quotes ambiguous scalars.
yq -p=xml -o=yaml '.' document.xml

# Match the key convention used on this page:
yq -p=xml -o=yaml \
   --xml-attribute-prefix='attr_' \
   --xml-content-name='text' \
   '.' document.xml > out.yaml

# Then load it back with the parser that will actually consume it. This is
# the only check that proves nothing changed type on the way through:
python -c "import yaml; print(yaml.safe_load(open('out.yaml'))['order']['country'])"
# expect: NO      not: False