mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
c7c2ad5749
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
129 lines
2.7 KiB
Ruby
129 lines
2.7 KiB
Ruby
# frozen_string_literal: true
|
|
require_relative 'helper'
|
|
|
|
module Psych
|
|
class TestHash < TestCase
|
|
class X < Hash
|
|
end
|
|
|
|
class HashWithIvar < Hash
|
|
def initialize
|
|
@keys = []
|
|
super
|
|
end
|
|
|
|
def []=(k, v)
|
|
@keys << k
|
|
super(k, v)
|
|
end
|
|
end
|
|
|
|
class HashWithCustomInit < Hash
|
|
attr_reader :obj
|
|
def initialize(obj)
|
|
@obj = obj
|
|
end
|
|
end
|
|
|
|
class HashWithCustomInitNoIvar < Hash
|
|
def initialize(obj)
|
|
# *shrug*
|
|
end
|
|
end
|
|
|
|
def setup
|
|
super
|
|
@hash = { :a => 'b' }
|
|
end
|
|
|
|
def test_hash_with_ivar
|
|
t1 = HashWithIvar.new
|
|
t1[:foo] = :bar
|
|
t2 = Psych.unsafe_load(Psych.dump(t1))
|
|
assert_equal t1, t2
|
|
assert_cycle t1
|
|
end
|
|
|
|
def test_referenced_hash_with_ivar
|
|
a = [1,2,3,4,5]
|
|
t1 = [HashWithCustomInit.new(a)]
|
|
t1 << t1.first
|
|
assert_cycle t1
|
|
end
|
|
|
|
def test_custom_initialized
|
|
a = [1,2,3,4,5]
|
|
t1 = HashWithCustomInit.new(a)
|
|
t2 = Psych.unsafe_load(Psych.dump(t1))
|
|
assert_equal t1, t2
|
|
assert_cycle t1
|
|
end
|
|
|
|
def test_custom_initialize_no_ivar
|
|
t1 = HashWithCustomInitNoIvar.new(nil)
|
|
t2 = Psych.unsafe_load(Psych.dump(t1))
|
|
assert_equal t1, t2
|
|
assert_cycle t1
|
|
end
|
|
|
|
def test_hash_subclass_with_ivars
|
|
x = X.new
|
|
x[:a] = 'b'
|
|
x.instance_variable_set :@foo, 'bar'
|
|
dup = Psych.unsafe_load Psych.dump x
|
|
assert_cycle x
|
|
assert_equal 'bar', dup.instance_variable_get(:@foo)
|
|
assert_equal X, dup.class
|
|
end
|
|
|
|
def test_load_with_class_syck_compatibility
|
|
hash = Psych.unsafe_load "--- !ruby/object:Hash\n:user_id: 7\n:username: Lucas\n"
|
|
assert_equal({ user_id: 7, username: 'Lucas'}, hash)
|
|
end
|
|
|
|
def test_empty_subclass
|
|
assert_match "!ruby/hash:#{X}", Psych.dump(X.new)
|
|
x = Psych.unsafe_load Psych.dump X.new
|
|
assert_equal X, x.class
|
|
end
|
|
|
|
def test_map
|
|
x = Psych.unsafe_load "--- !map:#{X} { }\n"
|
|
assert_equal X, x.class
|
|
end
|
|
|
|
def test_self_referential
|
|
@hash['self'] = @hash
|
|
assert_cycle(@hash)
|
|
end
|
|
|
|
def test_cycles
|
|
assert_cycle(@hash)
|
|
end
|
|
|
|
def test_ref_append
|
|
hash = Psych.unsafe_load(<<-eoyml)
|
|
---
|
|
foo: &foo
|
|
hello: world
|
|
bar:
|
|
<<: *foo
|
|
eoyml
|
|
assert_equal({"foo"=>{"hello"=>"world"}, "bar"=>{"hello"=>"world"}}, hash)
|
|
end
|
|
|
|
def test_key_deduplication
|
|
unless String.method_defined?(:-@) && (-("a" * 20)).equal?((-("a" * 20)))
|
|
pend "This Ruby implementation doesn't support string deduplication"
|
|
end
|
|
|
|
hashes = Psych.load(<<-eoyml)
|
|
---
|
|
- unique_identifier: 1
|
|
- unique_identifier: 2
|
|
eoyml
|
|
|
|
assert_same hashes[0].keys.first, hashes[1].keys.first
|
|
end
|
|
end
|
|
end
|