1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
ruby--ruby/test/psych/test_yaml_special_cases.rb
Aaron Patterson c7c2ad5749
[ruby/psych] Introduce Psych.unsafe_load
In future versions of Psych, the `load` method will be mostly the same
as the `safe_load` method.  In other words, the `load` method won't
allow arbitrary object deserialization (which can be used to escalate to
an RCE).  People that need to load *trusted* documents can use the
`unsafe_load` method.

This commit introduces the `unsafe_load` method so that people can
incrementally upgrade.  For example, if they try to upgrade to 4.0.0 and
something breaks, they can downgrade, audit callsites, change to
`safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
smoothly.

https://github.com/ruby/psych/commit/cb50aa8d3f
2021-05-17 11:20:45 +09:00

130 lines
3.9 KiB
Ruby

# frozen_string_literal: true
require_relative 'helper'
require 'stringio'
require 'tempfile'
module Psych
class TestYamlSpecialCases < TestCase
def setup
super
end
def test_empty_string
s = ""
assert_equal false, Psych.unsafe_load(s)
assert_equal [], Psych.load_stream(s)
assert_equal false, Psych.parse(s)
assert_equal [], Psych.parse_stream(s).transform
assert_nil Psych.safe_load(s)
end
def test_false
s = "false"
assert_equal false, Psych.load(s)
assert_equal [false], Psych.load_stream(s)
assert_equal false, Psych.parse(s).transform
assert_equal [false], Psych.parse_stream(s).transform
assert_equal false, Psych.safe_load(s)
end
def test_n
s = "n"
assert_equal "n", Psych.load(s)
assert_equal ["n"], Psych.load_stream(s)
assert_equal "n", Psych.parse(s).transform
assert_equal ["n"], Psych.parse_stream(s).transform
assert_equal "n", Psych.safe_load(s)
end
def test_off
s = "off"
assert_equal false, Psych.load(s)
assert_equal [false], Psych.load_stream(s)
assert_equal false, Psych.parse(s).transform
assert_equal [false], Psych.parse_stream(s).transform
assert_equal false, Psych.safe_load(s)
end
def test_inf
s = "-.inf"
assert_equal(-Float::INFINITY, Psych.load(s))
assert_equal([-Float::INFINITY], Psych.load_stream(s))
assert_equal(-Float::INFINITY, Psych.parse(s).transform)
assert_equal([-Float::INFINITY], Psych.parse_stream(s).transform)
assert_equal(-Float::INFINITY, Psych.safe_load(s))
end
def test_NaN
s = ".NaN"
assert Psych.load(s).nan?
assert Psych.load_stream(s).first.nan?
assert Psych.parse(s).transform.nan?
assert Psych.parse_stream(s).transform.first.nan?
assert Psych.safe_load(s).nan?
end
def test_0xC
s = "0xC"
assert_equal 12, Psych.load(s)
assert_equal [12], Psych.load_stream(s)
assert_equal 12, Psych.parse(s).transform
assert_equal [12], Psych.parse_stream(s).transform
assert_equal 12, Psych.safe_load(s)
end
def test_arrows
s = "<<"
assert_equal "<<", Psych.load(s)
assert_equal ["<<"], Psych.load_stream(s)
assert_equal "<<", Psych.parse(s).transform
assert_equal ["<<"], Psych.parse_stream(s).transform
assert_equal "<<", Psych.safe_load(s)
end
def test_arrows_hash
s = "<<: {}"
assert_equal({}, Psych.load(s))
assert_equal [{}], Psych.load_stream(s)
assert_equal({}, Psych.parse(s).transform)
assert_equal [{}], Psych.parse_stream(s).transform
assert_equal({}, Psych.safe_load(s))
end
def test_thousand
s = "- 1000\n- +1000\n- 1_000"
assert_equal [1000, 1000, 1000], Psych.load(s)
assert_equal [[1000, 1000, 1000]], Psych.load_stream(s)
assert_equal [1000, 1000, 1000], Psych.parse(s).transform
assert_equal [[1000, 1000, 1000]], Psych.parse_stream(s).transform
assert_equal [1000, 1000, 1000], Psych.safe_load(s)
end
def test_8
s = "[8, 08, 0o10, 010]"
assert_equal [8, "08", "0o10", 8], Psych.load(s)
assert_equal [[8, "08", "0o10", 8]], Psych.load_stream(s)
assert_equal [8, "08", "0o10", 8], Psych.parse(s).transform
assert_equal [[8, "08", "0o10", 8]], Psych.parse_stream(s).transform
assert_equal [8, "08", "0o10", 8], Psych.safe_load(s)
end
def test_null
s = "null"
assert_nil Psych.load(s)
assert_equal [nil], Psych.load_stream(s)
assert_nil Psych.parse(s).transform
assert_equal [nil], Psych.parse_stream(s).transform
assert_nil Psych.safe_load(s)
end
private
def special_case_cycle(object)
%w[load load_stream parse parse_stream safe_load].map do |m|
Psych.public_send(m, object)
end
end
end
end