Skip to content
  • Aaron Patterson's avatar
    c7c2ad57
    [ruby/psych] Introduce `Psych.unsafe_load` · c7c2ad57
    Aaron Patterson authored
    In future versions of Psych, the `load` method will be mostly the same
    as the `safe_load` method.  In other words, the `load` method won't
    allow arbitrary object deserialization (which can be used to escalate to
    an RCE).  People that need to load *trusted* documents can use the
    `unsafe_load` method.
    
    This commit introduces the `unsafe_load` method so that people can
    incrementally upgrade.  For example, if they try to upgrade to 4.0.0 and
    something breaks, they can downgrade, audit callsites, change to
    `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
    smoothly.
    
    https://github.com/ruby/psych/commit/cb50aa8d3f
    c7c2ad57
    [ruby/psych] Introduce `Psych.unsafe_load`
    Aaron Patterson authored
    In future versions of Psych, the `load` method will be mostly the same
    as the `safe_load` method.  In other words, the `load` method won't
    allow arbitrary object deserialization (which can be used to escalate to
    an RCE).  People that need to load *trusted* documents can use the
    `unsafe_load` method.
    
    This commit introduces the `unsafe_load` method so that people can
    incrementally upgrade.  For example, if they try to upgrade to 4.0.0 and
    something breaks, they can downgrade, audit callsites, change to
    `safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
    smoothly.
    
    https://github.com/ruby/psych/commit/cb50aa8d3f
Loading