Avoid accepting incorrect floating point values.

1 files changed, 11 insertions, 1 deletions

diff --git a/lib/psych/scalar_scanner.rb b/lib/psych/scalar_scanner.rb
index b92d3c0..3e8acbb 100644
--- a/lib/psych/scalar_scanner.rb
+++ b/lib/psych/scalar_scanner.rb
@@ -7,6 +7,12 @@ module Psych
     # Taken from http://yaml.org/type/timestamp.html
     TIME = /^\d{4}-\d{1,2}-\d{1,2}([Tt]|\s+)\d{1,2}:\d\d:\d\d(\.\d*)?(\s*Z|[-+]\d{1,2}(:\d\d)?)?/
 
+    # Taken from http://yaml.org/type/float.html
+    FLOAT = /^(?:[-+]?([0-9][0-9_,]*)?\.[0-9.]*([eE][-+][0-9]+)?(?# base 10)
+              |[-+]?[0-9][0-9_,]*(:[0-5]?[0-9])+\.[0-9_]*(?# base 60)
+              |[-+]?\.(inf|Inf|INF)(?# infinity)
+              |\.(nan|NaN|NAN)(?# not a number))$/x
+
     # Create a new scanner
     def initialize
       @string_cache = {}
@@ -67,10 +73,14 @@ module Psych
           i += (n.to_f * 60 ** (e - 2).abs)
         end
         i
+      when FLOAT
+        return Float(string.gsub(/[,_]/, '')) rescue ArgumentError
+
+        @string_cache[string] = true
+        string
       else
         if string.count('.') < 2
           return Integer(string.gsub(/[,_]/, '')) rescue ArgumentError
-          return Float(string.gsub(/[,_]/, '')) rescue ArgumentError
         end
 
         @string_cache[string] = true