mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
c7c2ad5749
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
50 lines
932 B
Ruby
50 lines
932 B
Ruby
# frozen_string_literal: true
|
|
require_relative 'helper'
|
|
|
|
module Psych
|
|
class TestSet < TestCase
|
|
def setup
|
|
super
|
|
@set = Psych::Set.new
|
|
@set['foo'] = 'bar'
|
|
@set['bar'] = 'baz'
|
|
end
|
|
|
|
def test_dump
|
|
assert_match(/!set/, Psych.dump(@set))
|
|
end
|
|
|
|
def test_roundtrip
|
|
assert_cycle(@set)
|
|
end
|
|
|
|
###
|
|
# FIXME: Syck should also support !!set as shorthand
|
|
def test_load_from_yaml
|
|
loaded = Psych.unsafe_load(<<-eoyml)
|
|
--- !set
|
|
foo: bar
|
|
bar: baz
|
|
eoyml
|
|
assert_equal(@set, loaded)
|
|
end
|
|
|
|
def test_loaded_class
|
|
assert_instance_of(Psych::Set, Psych.unsafe_load(Psych.dump(@set)))
|
|
end
|
|
|
|
def test_set_shorthand
|
|
loaded = Psych.unsafe_load(<<-eoyml)
|
|
--- !!set
|
|
foo: bar
|
|
bar: baz
|
|
eoyml
|
|
assert_instance_of(Psych::Set, loaded)
|
|
end
|
|
|
|
def test_set_self_reference
|
|
@set['self'] = @set
|
|
assert_cycle(@set)
|
|
end
|
|
end
|
|
end
|