mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
c7c2ad5749
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
45 lines
830 B
Ruby
45 lines
830 B
Ruby
# frozen_string_literal: true
|
|
require_relative 'helper'
|
|
|
|
module Psych
|
|
class Tagged
|
|
yaml_tag '!foo'
|
|
|
|
attr_accessor :baz
|
|
|
|
def initialize
|
|
@baz = 'bar'
|
|
end
|
|
end
|
|
|
|
class Foo
|
|
attr_accessor :parent
|
|
|
|
def initialize parent
|
|
@parent = parent
|
|
end
|
|
end
|
|
|
|
class TestObject < TestCase
|
|
def test_dump_with_tag
|
|
tag = Tagged.new
|
|
assert_match('foo', Psych.dump(tag))
|
|
end
|
|
|
|
def test_tag_round_trip
|
|
tag = Tagged.new
|
|
tag2 = Psych.unsafe_load(Psych.dump(tag))
|
|
assert_equal tag.baz, tag2.baz
|
|
assert_instance_of(Tagged, tag2)
|
|
end
|
|
|
|
def test_cyclic_references
|
|
foo = Foo.new(nil)
|
|
foo.parent = foo
|
|
loaded = Psych.unsafe_load Psych.dump foo
|
|
|
|
assert_instance_of(Foo, loaded)
|
|
assert_equal loaded, loaded.parent
|
|
end
|
|
end
|
|
end
|