mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
39 lines
1 KiB
Ruby
39 lines
1 KiB
Ruby
require_relative '../spec_helper'
|
|
require 'json'
|
|
|
|
module JSONSpecs
|
|
class MyClass
|
|
def initialize(foo)
|
|
@foo = foo
|
|
end
|
|
|
|
def self.json_create(hash)
|
|
new(*hash['args'])
|
|
end
|
|
|
|
def to_json(*args)
|
|
{ 'json_class' => self.class.name, 'args' => [ @foo ] }.to_json(*args)
|
|
end
|
|
end
|
|
end
|
|
|
|
guard -> {
|
|
JSON.const_defined?(:Pure) or
|
|
version_is(JSON::VERSION, '2.3.0')
|
|
} do
|
|
describe "CVE-2020-10663 is resisted by" do
|
|
it "only creating custom objects if passed create_additions: true or using JSON.load" do
|
|
obj = JSONSpecs::MyClass.new("bar")
|
|
JSONSpecs::MyClass.should.json_creatable?
|
|
json = JSON.dump(obj)
|
|
|
|
JSON.parse(json, create_additions: true).class.should == JSONSpecs::MyClass
|
|
JSON(json, create_additions: true).class.should == JSONSpecs::MyClass
|
|
JSON.load(json).class.should == JSONSpecs::MyClass
|
|
|
|
JSON.parse(json).class.should == Hash
|
|
JSON.parse(json, nil).class.should == Hash
|
|
JSON(json).class.should == Hash
|
|
end
|
|
end
|
|
end
|