mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
88e46cf6b8
After reading [this blog post](https://blog.rubygems.org/2011/08/31/shaving-the-yaml-yak.html), published almost 10 years ago already, my understanding is that this problem could come up in two ways: * Rubygems.org serving corrupted gemspecs". As far as I understand this was fixed in rubygems.org a lot time ago, since https://github.com/rubygems/rubygems.org/pull/331. * Clients having a ten years old gemspec cache with some of these bad gemspecs. In this case, there's no easy solution but I think ten years is enough and rebuilding the cache should do the trick. So, I think it's time we remove this. https://github.com/rubygems/rubygems/commit/afcb15d556
57 lines
1.5 KiB
Ruby
57 lines
1.5 KiB
Ruby
module Gem
|
|
|
|
###
|
|
# This module is used for safely loading YAML specs from a gem. The
|
|
# `safe_load` method defined on this module is specifically designed for
|
|
# loading Gem specifications. For loading other YAML safely, please see
|
|
# Psych.safe_load
|
|
|
|
module SafeYAML
|
|
PERMITTED_CLASSES = %w[
|
|
Symbol
|
|
Time
|
|
Date
|
|
Gem::Dependency
|
|
Gem::Platform
|
|
Gem::Requirement
|
|
Gem::Specification
|
|
Gem::Version
|
|
Gem::Version::Requirement
|
|
].freeze
|
|
|
|
PERMITTED_SYMBOLS = %w[
|
|
development
|
|
runtime
|
|
].freeze
|
|
|
|
if ::YAML.respond_to? :safe_load
|
|
def self.safe_load(input)
|
|
if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1')
|
|
::YAML.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: true)
|
|
else
|
|
::YAML.safe_load(input, PERMITTED_CLASSES, PERMITTED_SYMBOLS, true)
|
|
end
|
|
end
|
|
|
|
def self.load(input)
|
|
if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1')
|
|
::YAML.safe_load(input, permitted_classes: [::Symbol])
|
|
else
|
|
::YAML.safe_load(input, [::Symbol])
|
|
end
|
|
end
|
|
else
|
|
unless Gem::Deprecate.skip
|
|
warn "YAML safe loading is not available. Please upgrade psych to a version that supports safe loading (>= 2.0)."
|
|
end
|
|
|
|
def self.safe_load(input, *args)
|
|
::YAML.load input
|
|
end
|
|
|
|
def self.load(input)
|
|
::YAML.load input
|
|
end
|
|
end
|
|
end
|
|
end
|