1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
ruby--ruby/test/psych/test_hash.rb
Aaron Patterson c7c2ad5749
[ruby/psych] Introduce Psych.unsafe_load
In future versions of Psych, the `load` method will be mostly the same
as the `safe_load` method.  In other words, the `load` method won't
allow arbitrary object deserialization (which can be used to escalate to
an RCE).  People that need to load *trusted* documents can use the
`unsafe_load` method.

This commit introduces the `unsafe_load` method so that people can
incrementally upgrade.  For example, if they try to upgrade to 4.0.0 and
something breaks, they can downgrade, audit callsites, change to
`safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
smoothly.

https://github.com/ruby/psych/commit/cb50aa8d3f
2021-05-17 11:20:45 +09:00

129 lines
2.7 KiB
Ruby

# frozen_string_literal: true
require_relative 'helper'
module Psych
class TestHash < TestCase
class X < Hash
end
class HashWithIvar < Hash
def initialize
@keys = []
super
end
def []=(k, v)
@keys << k
super(k, v)
end
end
class HashWithCustomInit < Hash
attr_reader :obj
def initialize(obj)
@obj = obj
end
end
class HashWithCustomInitNoIvar < Hash
def initialize(obj)
# *shrug*
end
end
def setup
super
@hash = { :a => 'b' }
end
def test_hash_with_ivar
t1 = HashWithIvar.new
t1[:foo] = :bar
t2 = Psych.unsafe_load(Psych.dump(t1))
assert_equal t1, t2
assert_cycle t1
end
def test_referenced_hash_with_ivar
a = [1,2,3,4,5]
t1 = [HashWithCustomInit.new(a)]
t1 << t1.first
assert_cycle t1
end
def test_custom_initialized
a = [1,2,3,4,5]
t1 = HashWithCustomInit.new(a)
t2 = Psych.unsafe_load(Psych.dump(t1))
assert_equal t1, t2
assert_cycle t1
end
def test_custom_initialize_no_ivar
t1 = HashWithCustomInitNoIvar.new(nil)
t2 = Psych.unsafe_load(Psych.dump(t1))
assert_equal t1, t2
assert_cycle t1
end
def test_hash_subclass_with_ivars
x = X.new
x[:a] = 'b'
x.instance_variable_set :@foo, 'bar'
dup = Psych.unsafe_load Psych.dump x
assert_cycle x
assert_equal 'bar', dup.instance_variable_get(:@foo)
assert_equal X, dup.class
end
def test_load_with_class_syck_compatibility
hash = Psych.unsafe_load "--- !ruby/object:Hash\n:user_id: 7\n:username: Lucas\n"
assert_equal({ user_id: 7, username: 'Lucas'}, hash)
end
def test_empty_subclass
assert_match "!ruby/hash:#{X}", Psych.dump(X.new)
x = Psych.unsafe_load Psych.dump X.new
assert_equal X, x.class
end
def test_map
x = Psych.unsafe_load "--- !map:#{X} { }\n"
assert_equal X, x.class
end
def test_self_referential
@hash['self'] = @hash
assert_cycle(@hash)
end
def test_cycles
assert_cycle(@hash)
end
def test_ref_append
hash = Psych.unsafe_load(<<-eoyml)
---
foo: &foo
hello: world
bar:
<<: *foo
eoyml
assert_equal({"foo"=>{"hello"=>"world"}, "bar"=>{"hello"=>"world"}}, hash)
end
def test_key_deduplication
unless String.method_defined?(:-@) && (-("a" * 20)).equal?((-("a" * 20)))
pend "This Ruby implementation doesn't support string deduplication"
end
hashes = Psych.load(<<-eoyml)
---
- unique_identifier: 1
- unique_identifier: 2
eoyml
assert_same hashes[0].keys.first, hashes[1].keys.first
end
end
end