mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
c7c2ad5749
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
64 lines
1.2 KiB
Ruby
64 lines
1.2 KiB
Ruby
# frozen_string_literal: true
|
|
require_relative 'helper'
|
|
|
|
module Psych
|
|
class TestArray < TestCase
|
|
class X < Array
|
|
end
|
|
|
|
class Y < Array
|
|
attr_accessor :val
|
|
end
|
|
|
|
def setup
|
|
super
|
|
@list = [{ :a => 'b' }, 'foo']
|
|
end
|
|
|
|
def test_enumerator
|
|
x = [1, 2, 3, 4]
|
|
y = Psych.load Psych.dump x.to_enum
|
|
assert_equal x, y
|
|
end
|
|
|
|
def test_another_subclass_with_attributes
|
|
y = Y.new.tap {|o| o.val = 1}
|
|
y << "foo" << "bar"
|
|
y = Psych.unsafe_load Psych.dump y
|
|
|
|
assert_equal %w{foo bar}, y
|
|
assert_equal Y, y.class
|
|
assert_equal 1, y.val
|
|
end
|
|
|
|
def test_subclass
|
|
yaml = Psych.dump X.new
|
|
assert_match X.name, yaml
|
|
|
|
list = X.new
|
|
list << 1
|
|
assert_equal X, list.class
|
|
assert_equal 1, list.first
|
|
end
|
|
|
|
def test_subclass_with_attributes
|
|
y = Psych.unsafe_load Psych.dump Y.new.tap {|o| o.val = 1}
|
|
assert_equal Y, y.class
|
|
assert_equal 1, y.val
|
|
end
|
|
|
|
def test_backwards_with_syck
|
|
x = Psych.unsafe_load "--- !seq:#{X.name} []\n\n"
|
|
assert_equal X, x.class
|
|
end
|
|
|
|
def test_self_referential
|
|
@list << @list
|
|
assert_cycle(@list)
|
|
end
|
|
|
|
def test_cycle
|
|
assert_cycle(@list)
|
|
end
|
|
end
|
|
end
|