Use YAML.unsafe_load on Ruby 3.1.0 and newer #1898
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I haven't tested this one yet. I tried tonight but my spare install of ruby 3.0.2 was not built correctly and now it is sleep time. |
On older rubies, YAML.load _is_ the unsafe load method. At some point,
Ruby 3.1.0 / Psych 4(?) made two renames:
* YAML.load -> YAML.unsafe_load
* YAML.safe_load -> YAML.load
A quick test is to try converting a gem. This would fail if `YAML.load`
was the "safe" method because it would fail with this message:
Tried to load unspecified class: Gem::Specification (Psych::DisallowedClass
`fpm -s gem -t empty rails` will crash on Ruby 3.1.0 prior to this
commit.
Fixes #1895
Add necessary classes to safely load yaml from gem specs
|
Testing both ruby 3.1.0 and 3.0.2, tests pass! Prior to this PR, Ruby 3.0.2 would pass tests, but Ruby 3.1.0 would not due to the upstream Psych change. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Load gem specifications using YAML's safe loading
On older rubies, YAML.load is the unsafe load method. At some point,
Ruby 3.1.0 / Psych 4(?) made two renames:
A quick test is to try converting a gem. This would fail if
YAML.loadwas the "safe" method because it would fail with this message:
fpm -s gem -t empty railswill crash on Ruby 3.1.0 prior to thiscommit.
Fixes #1895