From cb50aa8d3fb8be01897becff77b4922b12a0ab4c Mon Sep 17 00:00:00 2001
From: Aaron Patterson <tenderlove@ruby-lang.org>
Date: Mon, 10 May 2021 09:50:06 -0700
Subject: Introduce `Psych.unsafe_load`

In future versions of Psych, the `load` method will be mostly the same
as the `safe_load` method.  In other words, the `load` method won't
allow arbitrary object deserialization (which can be used to escalate to
an RCE).  People that need to load *trusted* documents can use the
`unsafe_load` method.

This commit introduces the `unsafe_load` method so that people can
incrementally upgrade.  For example, if they try to upgrade to 4.0.0 and
something breaks, they can downgrade, audit callsites, change to
`safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
smoothly.
---
 test/psych/test_yaml.rb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'test/psych/test_yaml.rb')

diff --git a/test/psych/test_yaml.rb b/test/psych/test_yaml.rb
index b16a00f..e12b976 100644
--- a/test/psych/test_yaml.rb
+++ b/test/psych/test_yaml.rb
@@ -573,7 +573,7 @@ EOY
 	end
 
 	def test_spec_root_mapping
-		y = Psych::load( <<EOY
+		y = Psych::unsafe_load( <<EOY
 # This stream is an example of a top-level mapping.
 invoice : 34843
 date    : 2001-01-23
@@ -1077,7 +1077,7 @@ EOY
 
 		# Read Psych dumped by the ruby 1.8.3.
 		assert_to_yaml( Rational(1, 2), "!ruby/object:Rational 1/2\n" )
-		assert_raise( ArgumentError ) { Psych.load("!ruby/object:Rational INVALID/RATIONAL\n") }
+		assert_raise( ArgumentError ) { Psych.unsafe_load("!ruby/object:Rational INVALID/RATIONAL\n") }
 	end
 
 	def test_ruby_complex
@@ -1089,7 +1089,7 @@ EOY
 
 		# Read Psych dumped by the ruby 1.8.3.
 		assert_to_yaml( Complex(3, 4), "!ruby/object:Complex 3+4i\n" )
-		assert_raise( ArgumentError ) { Psych.load("!ruby/object:Complex INVALID+COMPLEXi\n") }
+		assert_raise( ArgumentError ) { Psych.unsafe_load("!ruby/object:Complex INVALID+COMPLEXi\n") }
 	end
 
 	def test_emitting_indicators
@@ -1209,7 +1209,7 @@ EOY
     def test_circular_references
         a = []; a[0] = a; a[1] = a
         inspect_str = "[[...], [...]]"
-        assert_equal( inspect_str, Psych::load(Psych.dump(a)).inspect )
+        assert_equal( inspect_str, Psych::unsafe_load(Psych.dump(a)).inspect )
     end
 
     #
@@ -1264,11 +1264,11 @@ EOY
     end
 
     def test_date_out_of_range
-      Psych::load('1900-01-01T00:00:00+00:00')
+      Psych::unsafe_load('1900-01-01T00:00:00+00:00')
     end
 
     def test_normal_exit
-      Psych.load("2000-01-01 00:00:00.#{"0"*1000} +00:00\n")
+      Psych.unsafe_load("2000-01-01 00:00:00.#{"0"*1000} +00:00\n")
       # '[ruby-core:13735]'
     end
 
-- 
cgit v1.2.3