mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
c7c2ad5749
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
63 lines
1.4 KiB
Ruby
63 lines
1.4 KiB
Ruby
# frozen_string_literal: true
|
|
require_relative 'helper'
|
|
require 'delegate'
|
|
|
|
module Psych
|
|
class TestMarshalable < TestCase
|
|
def test_objects_defining_marshal_dump_and_marshal_load_can_be_dumped
|
|
sd = SimpleDelegator.new(1)
|
|
loaded = Psych.unsafe_load(Psych.dump(sd))
|
|
|
|
assert_instance_of(SimpleDelegator, loaded)
|
|
assert_equal(sd, loaded)
|
|
end
|
|
|
|
class PsychCustomMarshalable < BasicObject
|
|
attr_reader :foo
|
|
|
|
def initialize(foo)
|
|
@foo = foo
|
|
end
|
|
|
|
def marshal_dump
|
|
[foo]
|
|
end
|
|
|
|
def mashal_load(data)
|
|
@foo = data[0]
|
|
end
|
|
|
|
def init_with(coder)
|
|
@foo = coder['foo']
|
|
end
|
|
|
|
def encode_with(coder)
|
|
coder['foo'] = 2
|
|
end
|
|
|
|
def respond_to?(method)
|
|
[:marshal_dump, :marshal_load, :init_with, :encode_with].include?(method)
|
|
end
|
|
|
|
def class
|
|
PsychCustomMarshalable
|
|
end
|
|
end
|
|
|
|
def test_init_with_takes_priority_over_marshal_methods
|
|
obj = PsychCustomMarshalable.new(1)
|
|
loaded = Psych.unsafe_load(Psych.dump(obj))
|
|
|
|
assert(PsychCustomMarshalable === loaded)
|
|
assert_equal(2, loaded.foo)
|
|
end
|
|
|
|
def test_init_symbolize_names
|
|
obj = PsychCustomMarshalable.new(1)
|
|
loaded = Psych.unsafe_load(Psych.dump(obj), symbolize_names: true)
|
|
|
|
assert(PsychCustomMarshalable === loaded)
|
|
assert_equal(2, loaded.foo)
|
|
end
|
|
end
|
|
end
|