Age | Commit message (Collapse) | Author |
|
In future versions of Psych, the `load` method will be mostly the same
as the `safe_load` method. In other words, the `load` method won't
allow arbitrary object deserialization (which can be used to escalate to
an RCE). People that need to load *trusted* documents can use the
`unsafe_load` method.
This commit introduces the `unsafe_load` method so that people can
incrementally upgrade. For example, if they try to upgrade to 4.0.0 and
something breaks, they can downgrade, audit callsites, change to
`safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
smoothly.
https://github.com/ruby/psych/commit/cb50aa8d3f
|
|
https://github.com/ruby/psych/commit/01e7310dd3
|
|
* Rely on encoding tags to determine if string should be dumped as binary.
https://github.com/ruby/psych/commit/8949a47b8cee31e03e21608406ba116adcf74054
* Specify "frozen_string_literal: true".
* Support to binary release for mingw32 platform.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59327 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
* Removed deprecated code.
* Removed code related syck gem.
* Fixed typos.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58256 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
When you change this to true, you may need to add more tests.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53141 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
* test/psych/*: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@52920 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
* test/psych/*: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@51657 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
* ext/psych/psych.gemspec: ditto
* ext/psych/yaml/scanner.c: add latest libyaml change.
* test/psych/helper.rb: support newer minitest
* test/psych/test_to_yaml_properties.rb: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@49632 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@42719 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
defined, restricted subset of Ruby object types.
* ext/psych/lib/psych/class_loader.rb: A class loader for
encapsulating the logic for which objects are allowed to be
deserialized.
* ext/psych/lib/psych/deprecated.rb: Changes to use the class loader
* ext/psych/lib/psych/exception.rb: ditto
* ext/psych/lib/psych/json/stream.rb: ditto
* ext/psych/lib/psych/nodes/node.rb: ditto
* ext/psych/lib/psych/scalar_scanner.rb: ditto
* ext/psych/lib/psych/stream.rb: ditto
* ext/psych/lib/psych/streaming.rb: ditto
* ext/psych/lib/psych/visitors/json_tree.rb: ditto
* ext/psych/lib/psych/visitors/to_ruby.rb: ditto
* ext/psych/lib/psych/visitors/yaml_tree.rb: ditto
* ext/psych/psych_to_ruby.c: ditto
* test/psych/helper.rb: ditto
* test/psych/test_safe_load.rb: tests for restricted subset.
* test/psych/test_scalar_scanner.rb: ditto
* test/psych/visitors/test_to_ruby.rb: ditto
* test/psych/visitors/test_yaml_tree.rb: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@40750 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
port the functions from envutil to the test helper.
* test/psych/test_deprecated.rb: ditto
* test/psych/test_encoding.rb: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@40749 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@40049 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
* ext/psych/lib/psych/nodes/node.rb: Rename `to_yaml` to just `yaml`
in order to avoid YAML::ENGINE switching from replacing this method.
* test/psych/helper.rb: fix tests for method name change.
* test/psych/test_document.rb: ditto
* test/psych/visitors/test_emitter.rb: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33384 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33209 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
* test/psych/*: ditto
* lib/psych/*: ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@27079 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|