summaryrefslogtreecommitdiff
path: root/test/psych/test_psych.rb
diff options
context:
space:
mode:
authorAaron Patterson <tenderlove@ruby-lang.org>2021-05-10 09:50:06 -0700
committerHiroshi SHIBATA <hsbt@ruby-lang.org>2021-05-17 11:20:45 +0900
commitc7c2ad5749f7f0767ef38be160f4b391228396c1 (patch)
tree38a9d1db4a3a5dd2f5efa3705c9f3be51ccadef5 /test/psych/test_psych.rb
parentbcaa6aeceadd34eb6a0de1d55bf17ecb153a7916 (diff)
[ruby/psych] Introduce `Psych.unsafe_load`
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
Diffstat (limited to 'test/psych/test_psych.rb')
-rw-r--r--test/psych/test_psych.rb22
1 files changed, 11 insertions, 11 deletions
diff --git a/test/psych/test_psych.rb b/test/psych/test_psych.rb
index 9eea4a0..912bcb9 100644
--- a/test/psych/test_psych.rb
+++ b/test/psych/test_psych.rb
@@ -84,7 +84,7 @@ class TestPsych < Psych::TestCase
def test_non_existing_class_on_deserialize
e = assert_raise(ArgumentError) do
- Psych.load("--- !ruby/object:NonExistent\nfoo: 1")
+ Psych.unsafe_load("--- !ruby/object:NonExistent\nfoo: 1")
end
assert_equal 'undefined class/module NonExistent', e.message
end
@@ -222,28 +222,28 @@ class TestPsych < Psych::TestCase
end
def test_load_default_fallback
- assert_equal false, Psych.load("")
+ assert_equal false, Psych.unsafe_load("")
end
def test_load_with_fallback
- assert_equal 42, Psych.load("", "file", fallback: 42)
+ assert_equal 42, Psych.load("", filename: "file", fallback: 42)
end
def test_load_with_fallback_nil_or_false
- assert_nil Psych.load("", "file", fallback: nil)
- assert_equal false, Psych.load("", "file", fallback: false)
+ assert_nil Psych.load("", filename: "file", fallback: nil)
+ assert_equal false, Psych.load("", filename: "file", fallback: false)
end
def test_load_with_fallback_hash
- assert_equal Hash.new, Psych.load("", "file", fallback: Hash.new)
+ assert_equal Hash.new, Psych.load("", filename: "file", fallback: Hash.new)
end
def test_load_with_fallback_for_nil
- assert_nil Psych.load("--- null", "file", fallback: 42)
+ assert_nil Psych.unsafe_load("--- null", "file", fallback: 42)
end
def test_load_with_fallback_for_false
- assert_equal false, Psych.load("--- false", "file", fallback: 42)
+ assert_equal false, Psych.unsafe_load("--- false", "file", fallback: 42)
end
def test_load_file
@@ -278,7 +278,7 @@ class TestPsych < Psych::TestCase
def test_load_file_default_fallback
Tempfile.create(['empty', 'yml']) {|t|
- assert_equal false, Psych.load_file(t.path)
+ assert_equal false, Psych.unsafe_load_file(t.path)
}
end
@@ -347,9 +347,9 @@ class TestPsych < Psych::TestCase
end
def test_degenerate_strings
- assert_equal false, Psych.load(' ')
+ assert_equal false, Psych.unsafe_load(' ')
assert_equal false, Psych.parse(' ')
- assert_equal false, Psych.load('')
+ assert_equal false, Psych.unsafe_load('')
assert_equal false, Psych.parse('')
end