Add a note about safe_load

1 files changed, 4 insertions, 0 deletions

diff --git a/lib/psych.rb b/lib/psych.rb
index 9513f79..c719b03 100644
--- a/lib/psych.rb
+++ b/lib/psych.rb
@@ -264,6 +264,10 @@ module Psych
   #
   # Raises a TypeError when `yaml` parameter is NilClass
   #
+  # NOTE: This method *should not* be used to parse untrusted documents, such as
+  # YAML documents that are supplied via user input.  Instead, please use the
+  # safe_load method.
+  #
   def self.load yaml, legacy_filename = NOT_GIVEN, filename: nil, fallback: false, symbolize_names: false
     if legacy_filename != NOT_GIVEN
       warn_with_uplevel 'Passing filename with the 2nd argument of Psych.load is deprecated. Use keyword argument like Psych.load(yaml, filename: ...) instead.', uplevel: 1 if $VERBOSE