diff options
| author | hsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-10-10 08:58:22 +0000 |
|---|---|---|
| committer | hsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-10-10 08:58:22 +0000 |
| commit | 500f15e5079026f3da993b404f7474aa3c69cc0a (patch) | |
| tree | 5d03277ea27cf1be4b4616482693be01fdf6f0e4 /lib/rubygems/package/old.rb | |
| parent | 6d86ee593a78221bfadd99fd9edf41eb5a985cc7 (diff) | |
Merge rubygems-2.6.14 changes.
It fixed http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60149 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/rubygems/package/old.rb')
| -rw-r--r-- | lib/rubygems/package/old.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/rubygems/package/old.rb b/lib/rubygems/package/old.rb index 88193b986d..f6e6e67c38 100644 --- a/lib/rubygems/package/old.rb +++ b/lib/rubygems/package/old.rb @@ -101,7 +101,7 @@ class Gem::Package::Old < Gem::Package header << line end - YAML.load header + Gem::SafeYAML.safe_load header end ## |