mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
c7c2ad5749
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
130 lines
3.9 KiB
Ruby
130 lines
3.9 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require_relative 'helper'
|
|
|
|
require 'stringio'
|
|
require 'tempfile'
|
|
|
|
module Psych
|
|
class TestYamlSpecialCases < TestCase
|
|
def setup
|
|
super
|
|
end
|
|
|
|
def test_empty_string
|
|
s = ""
|
|
assert_equal false, Psych.unsafe_load(s)
|
|
assert_equal [], Psych.load_stream(s)
|
|
assert_equal false, Psych.parse(s)
|
|
assert_equal [], Psych.parse_stream(s).transform
|
|
assert_nil Psych.safe_load(s)
|
|
end
|
|
|
|
def test_false
|
|
s = "false"
|
|
assert_equal false, Psych.load(s)
|
|
assert_equal [false], Psych.load_stream(s)
|
|
assert_equal false, Psych.parse(s).transform
|
|
assert_equal [false], Psych.parse_stream(s).transform
|
|
assert_equal false, Psych.safe_load(s)
|
|
end
|
|
|
|
def test_n
|
|
s = "n"
|
|
assert_equal "n", Psych.load(s)
|
|
assert_equal ["n"], Psych.load_stream(s)
|
|
assert_equal "n", Psych.parse(s).transform
|
|
assert_equal ["n"], Psych.parse_stream(s).transform
|
|
assert_equal "n", Psych.safe_load(s)
|
|
end
|
|
|
|
def test_off
|
|
s = "off"
|
|
assert_equal false, Psych.load(s)
|
|
assert_equal [false], Psych.load_stream(s)
|
|
assert_equal false, Psych.parse(s).transform
|
|
assert_equal [false], Psych.parse_stream(s).transform
|
|
assert_equal false, Psych.safe_load(s)
|
|
end
|
|
|
|
def test_inf
|
|
s = "-.inf"
|
|
assert_equal(-Float::INFINITY, Psych.load(s))
|
|
assert_equal([-Float::INFINITY], Psych.load_stream(s))
|
|
assert_equal(-Float::INFINITY, Psych.parse(s).transform)
|
|
assert_equal([-Float::INFINITY], Psych.parse_stream(s).transform)
|
|
assert_equal(-Float::INFINITY, Psych.safe_load(s))
|
|
end
|
|
|
|
def test_NaN
|
|
s = ".NaN"
|
|
assert Psych.load(s).nan?
|
|
assert Psych.load_stream(s).first.nan?
|
|
assert Psych.parse(s).transform.nan?
|
|
assert Psych.parse_stream(s).transform.first.nan?
|
|
assert Psych.safe_load(s).nan?
|
|
end
|
|
|
|
def test_0xC
|
|
s = "0xC"
|
|
assert_equal 12, Psych.load(s)
|
|
assert_equal [12], Psych.load_stream(s)
|
|
assert_equal 12, Psych.parse(s).transform
|
|
assert_equal [12], Psych.parse_stream(s).transform
|
|
assert_equal 12, Psych.safe_load(s)
|
|
end
|
|
|
|
def test_arrows
|
|
s = "<<"
|
|
assert_equal "<<", Psych.load(s)
|
|
assert_equal ["<<"], Psych.load_stream(s)
|
|
assert_equal "<<", Psych.parse(s).transform
|
|
assert_equal ["<<"], Psych.parse_stream(s).transform
|
|
assert_equal "<<", Psych.safe_load(s)
|
|
end
|
|
|
|
def test_arrows_hash
|
|
s = "<<: {}"
|
|
assert_equal({}, Psych.load(s))
|
|
assert_equal [{}], Psych.load_stream(s)
|
|
assert_equal({}, Psych.parse(s).transform)
|
|
assert_equal [{}], Psych.parse_stream(s).transform
|
|
assert_equal({}, Psych.safe_load(s))
|
|
end
|
|
|
|
def test_thousand
|
|
s = "- 1000\n- +1000\n- 1_000"
|
|
assert_equal [1000, 1000, 1000], Psych.load(s)
|
|
assert_equal [[1000, 1000, 1000]], Psych.load_stream(s)
|
|
assert_equal [1000, 1000, 1000], Psych.parse(s).transform
|
|
assert_equal [[1000, 1000, 1000]], Psych.parse_stream(s).transform
|
|
assert_equal [1000, 1000, 1000], Psych.safe_load(s)
|
|
end
|
|
|
|
def test_8
|
|
s = "[8, 08, 0o10, 010]"
|
|
assert_equal [8, "08", "0o10", 8], Psych.load(s)
|
|
assert_equal [[8, "08", "0o10", 8]], Psych.load_stream(s)
|
|
assert_equal [8, "08", "0o10", 8], Psych.parse(s).transform
|
|
assert_equal [[8, "08", "0o10", 8]], Psych.parse_stream(s).transform
|
|
assert_equal [8, "08", "0o10", 8], Psych.safe_load(s)
|
|
end
|
|
|
|
def test_null
|
|
s = "null"
|
|
assert_nil Psych.load(s)
|
|
assert_equal [nil], Psych.load_stream(s)
|
|
assert_nil Psych.parse(s).transform
|
|
assert_equal [nil], Psych.parse_stream(s).transform
|
|
assert_nil Psych.safe_load(s)
|
|
end
|
|
|
|
private
|
|
|
|
def special_case_cycle(object)
|
|
%w[load load_stream parse parse_stream safe_load].map do |m|
|
|
Psych.public_send(m, object)
|
|
end
|
|
end
|
|
end
|
|
end
|