summaryrefslogtreecommitdiff
path: root/ext/psych/lib
AgeCommit message (Collapse)Author
2024-01-18[ruby/psych] Add :stringify_names option to convert symbol keys to string ↵Robert Schulze
for dumping https://github.com/ruby/psych/commit/3d051d89aa
2024-01-17[ruby/psych] issue #443: quote Y and N when dumpingColin Kelley
https://github.com/ruby/psych/commit/93c8fb443a
2023-12-25[ruby/psych] Remove now-unreachable rescue blockAlexander Momchilov
https://github.com/ruby/psych/commit/6905a2123c
2023-12-25[ruby/psych] Remove unused arrayAlexander Momchilov
https://github.com/ruby/psych/commit/b9e7b4a4a4
2023-12-19[ruby/psych] Bump up 5.1.2Hiroshi SHIBATA
https://github.com/ruby/psych/commit/a9ab74d132
2023-12-19[ruby/psych] Use `compare_by_identity` instead of `object_id`Alexander Momchilov
Object IDs became more expensive in Ruby 2.7. Using `Hash#compare_by_identity` let's us get the same effect, without needing to force all these objects to have object_ids assigned to them. https://github.com/ruby/psych/commit/df69e4a12e
2023-11-27[ruby/psych] Prefer each_char in Psych::Visitors::Visitor::ToRuby#deserializeMau Magnaguagno
Use safe navigation operator with each_char to remove empty strings and improve readability. https://github.com/ruby/psych/commit/5fe714b216
2023-10-16[ruby/psych] Bump up v5.1.1.1Hiroshi SHIBATA
https://github.com/ruby/psych/commit/51cc86ff3f
2023-10-11[ruby/psych] Bump up v5.1.1Hiroshi SHIBATA
https://github.com/ruby/psych/commit/f306512d60
2023-10-02[ruby/psych] Update SnakeYAML Engine to 2.7Charles Oliver Nutter
https://github.com/ruby/psych/commit/094c811588
2023-07-05[ruby/psych] Extract accessor methods without forwardableHiroshi SHIBATA
We should leave additional dependency if we leave from them. https://github.com/ruby/psych/commit/3d0325a774
2023-07-01[ruby/psych] Remove private methods unused since #487Nobuyoshi Nakada
https://github.com/ruby/psych/commit/902c292f26
2023-02-07[ruby/psych] Bump version to 5.1 for releaseCharles Oliver Nutter
This version primarily updates the JRuby extension to use SnakeYAML Engine, a newer version of the SnakeYAML library, which also updates YAML support to 1.2. The JRuby extension now also exposes settings for the parser. https://github.com/ruby/psych/commit/6f2b16b343
2023-01-31Initial move to SnakeYAML EngineCharles Oliver Nutter
See jruby/jruby#7570 for some of the justification for this move. We only require the parser from SnakeYAML, but in the original form it is encumbered with Java object serialization code that keeps getting flagged as a CVE risk. We disagree with the assessment, at least as it pertains to JRuby (we do not use the code in question) but our inclusion of the library continues to get flagged by auditing tools. This commit starts the process of moving to the successor library, SnakeYAML Engine. The parser API is largely unchanged, except as seen in this commit. No Java exceptions are thrown, but a number of Psych tests fail (possibly due to Engine being YAML 1.2 only).
2023-01-23[ruby/psych] Fix RestrictedYAMLTree allowing the Symbol class should allow ↵Jean Boussier
all symbols Ref: https://github.com/ruby/psych/pull/495 That's how it works for `safe_load`: ```ruby >> YAML.safe_load(':foo', permitted_classes: [Symbol]) => :foo ``` So `safe_dump` should mirror that. https://github.com/ruby/psych/commit/592a75a656
2023-01-18[ruby/psych] Bump up 5.0.2Hiroshi SHIBATA
https://github.com/ruby/psych/commit/a170b8eb46
2023-01-17[ruby/psych] Bump up 5.0.2.pre1 for testingHiroshi SHIBATA
https://github.com/ruby/psych/commit/67ec299c68
2023-01-11[ruby/psych] Get rid of anonymous eval callsJean Boussier
Things declared in anonymous eval are always annoying to locate. https://github.com/ruby/psych/commit/38871ad4e5
2022-12-08[ruby/psych] Bump version to 5.0.1Hiroshi SHIBATA
https://github.com/ruby/psych/commit/bdf20e6042
2022-12-05[ruby/psych] Bump version to 5.0.0Hiroshi SHIBATA
https://github.com/ruby/psych/commit/4fed0941b9
2022-09-28[ruby/psych] Bump snakeyaml from 1.31 to 1.33Chad Wilson
https://github.com/ruby/psych/commit/8a761cdfb7
2022-09-20[ruby/psych] Convert some of Parser#parse to RubyAaron Patterson
This commit just converts some of the parse method to Ruby https://github.com/ruby/psych/commit/bca7d2c549
2022-09-07[ruby/psych] Bump snakeyaml from 1.28 to 1.31Chad Wilson
Resolves CVE-2022-25857, among other fixes. https://github.com/ruby/psych/commit/918cd25d37
2022-09-07[ruby/psych] Dump Date/DateTime as proleptic Gregorian date as well as TimeNobuyoshi Nakada
Fix ruby/psych#572 https://github.com/ruby/psych/commit/92304269bc
2022-08-09[ruby/psych] Raise specific error when an anchor isn't definedAlexander Momchilov
https://github.com/ruby/psych/commit/98fbd5247a
2022-08-09[ruby/psych] Raise specific error when aliases are not enabledAlexander Momchilov
https://github.com/ruby/psych/commit/0c11ddcf46
2022-05-18[ruby/psych] Prepare to develop 5.0.0Hiroshi SHIBATA
https://github.com/ruby/psych/commit/c3b5183f42
2022-05-18[ruby/psych] [CI] Add/update 'rake install', update Psych version for Ruby ↵MSP-Greg
3.1 gem install https://github.com/ruby/psych/commit/2fa5e190b5
2022-05-10[ruby/psych] tr is typically 4 to 5 times faster than gsubMSP-Greg
https://github.com/ruby/psych/commit/8533be8fe7
2022-01-22[ruby/psych] Add strict_integer option to parse numbers with commas as stringsSeth Boyles
Authored-by: Seth Boyles <sethboyles@gmail.com> https://github.com/ruby/psych/commit/75bebb37b8
2022-01-20[ruby/psych] Remove alias of load to unsafe_loadMichael Nikitochkin
https://github.com/ruby/psych/commit/39e23cc86f
2022-01-14[ruby/psych] Don't require `strscan` unnecessarilyDavid Rodríguez
It does not seem needed, and it's causing issues on Windows when uninstalling `strscan`, because strscan's shared library being used when RubyGems tries to remove it (because its loaded through Psych, which RubyGems uses for loading configuration). https://github.com/ruby/psych/commit/3911356ec1
2021-12-20[ruby/psych] Bump version to 4.0.3Hiroshi SHIBATA
https://github.com/ruby/psych/commit/75ab76e788
2021-10-24[ruby/psych] Prefer `require_relative` for internal requiresDavid Rodríguez
https://github.com/ruby/psych/commit/a0f55ee85a
2021-10-21[ruby/psych] Bump up psych version to 4.0.2Hiroshi SHIBATA
https://github.com/ruby/psych/commit/69a713f860
2021-08-31[ruby/psych] Replace A-Za-z with [:alpha:]jory-graham
https://github.com/ruby/psych/commit/8ec36494fb
2021-08-31[ruby/psych] Add quotes to the strings "y" and "n"Aaron Patterson
'y' and 'n' are kind of ambiguous. Syck treated y and n literals in YAML documents as strings. But this is not what the YAML 1.1 spec says. YAML 1.1 says they should be treated as booleans. When we're dumping documents, we know it's a string, so adding quotes will eliminate the "ambiguity" in the emitted document Fixes #443 https://github.com/ruby/psych/commit/6a1c30634e
2021-08-31[ruby/psych] Update lib/psych/scalar_scanner.rbopak
https://github.com/ruby/psych/commit/64cc239557 Co-authored-by: Olle Jonsson <olle.jonsson@gmail.com>
2021-08-31[ruby/psych] add more testsAlexandr Opak
https://github.com/ruby/psych/commit/8f71222bf3
2021-08-31[ruby/psych] fix parsing integer values with '_' at the endAlexandr Opak
https://github.com/ruby/psych/commit/e0bb853014
2021-08-31[ruby/psych] Improve float scalar scannerTomer Brisker
Previously, `+.inf` was not handled correctly. Additionally, the regexp was checking for inf and NaN, even though these cases are handled earlier in the condition. Added a few tests to ensure handling some missing cases. https://github.com/ruby/psych/commit/6e0e7a1e9f
2021-07-29[ruby/psych] fix: use git repository link for LibYAML in docsRhys Powell
LibYAML has moved from their previous Mercurial based hosting on BitBucket to a git repository on GitHub. This commit updates the `Psych` module's documentation to point to this new repository, instead of the old one which is now a 404. https://github.com/ruby/psych/commit/947a84d0dd
2021-06-07[ruby/psych] Bump version to 4.0.1Hiroshi SHIBATA
https://github.com/ruby/psych/commit/4049939006
2021-06-07[ruby/psych] Implement YAML.safe_dump to make safe_load more usable.Jean Boussier
In case where Psych is used as a two way serializers, e.g. to serialize some cache or config, it is preferable to have the same restrictions on both load and dump. Otherwise you might dump and persist some objects payloads that you later won't be able to read. https://github.com/ruby/psych/commit/441958396f
2021-06-07[ruby/psych] Make YAML.load_file use YAML.load instead of safe_loadYusuke Endoh
YAML.load and YAML.safe_load are different a little; the former allows Symbol by default but the latter doesn't. So YAML.load_file and YAML.safe_load_file should reflect the difference. Fixes #490 https://github.com/ruby/psych/commit/f8a5e512a1
2021-05-17[ruby/psych] remove deprecated interfaceAaron Patterson
https://github.com/ruby/psych/commit/0767227051
2021-05-17[ruby/psych] Bump versionAaron Patterson
https://github.com/ruby/psych/commit/1df86a2e81
2021-05-17[ruby/psych] Use Psych.safe_load by defaultAaron Patterson
Psych.load is not safe for use with untrusted data. Too many applications make the mistake of using `Psych.load` with untrusted data and that ends up with some kind of security vulnerability. This commit changes the default `Psych.load` to use `safe_load`. Users that want to parse trusted data can use Psych.unsafe_load. https://github.com/ruby/psych/commit/176494297f
2021-05-17[ruby/psych] Introduce `Psych.unsafe_load`Aaron Patterson
In future versions of Psych, the `load` method will be mostly the same as the `safe_load` method. In other words, the `load` method won't allow arbitrary object deserialization (which can be used to escalate to an RCE). People that need to load *trusted* documents can use the `unsafe_load` method. This commit introduces the `unsafe_load` method so that people can incrementally upgrade. For example, if they try to upgrade to 4.0.0 and something breaks, they can downgrade, audit callsites, change to `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0 smoothly. https://github.com/ruby/psych/commit/cb50aa8d3f
2021-05-17[ruby/psych] Fix symabolize_name with non-string keysJean Boussier
https://github.com/ruby/psych/commit/1c5c29e81f
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-23 15:08:26 +0000