In case where Psych is used as a two way serializers,
e.g. to serialize some cache or config, it is preferable
to have the same restrictions on both load and dump.
Otherwise you might dump and persist some objects payloads
that you later won't be able to read.
https://github.com/ruby/psych/commit/441958396f
In future versions of Psych, the `load` method will be mostly the same
as the `safe_load` method. In other words, the `load` method won't
allow arbitrary object deserialization (which can be used to escalate to
an RCE). People that need to load *trusted* documents can use the
`unsafe_load` method.
This commit introduces the `unsafe_load` method so that people can
incrementally upgrade. For example, if they try to upgrade to 4.0.0 and
something breaks, they can downgrade, audit callsites, change to
`safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
smoothly.
https://github.com/ruby/psych/commit/cb50aa8d3f
The only remaining use of this function was to get the internal
message object from an exception's hidden `mesg` instance
variable to allow it to be dumped wiithout converting to a string.
As discussed in #103, this exposes internal implementation details
of CRuby, and ultimately does not provide any real utility to the
user since they can't directly inspect this hidden variable. The
test change here is to reflect CRuby behavior that denies equality
if the internal message objects do not match, as is the case after
the exception has been loaded and now has a simple String value.
The impact to users is that exceptions with special hidden message
objects will convert those objects to String during marshaling
through YAML. I believe this only affects NameError and its
descendants, since users can't set this field directly on their
own exception types.
Fixes#103.
Ruby 2.7 deprecates taint and it no longer has an effect.
The lack of taint support should not cause a problem in
previous Ruby versions.
I'm not sure if the untaint calls in deduplicate are still needed
after the removal of tainting in the parser. If they are not
needed, they should be removed.
https://github.com/ruby/psych/commit/73c1a2b4e0
In verbose mode, `test_delegator` in `test/psych/visitors/test_yaml_tree.rb` shows following warning.
https://travis-ci.org/ruby/psych/jobs/562435717#L268
```
/home/travis/build/ruby/psych/test/psych/visitors/test_yaml_tree.rb:10: warning: instance variable @obj not initialized
```
This is because `Psych.load` bypasses #initialize with the #init_with method.
https://github.com/ruby/psych/commit/f99523388f
* Added deprecated warnings for the new interface of keyword argument.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@65193 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
It version changed fallback option to keywoad argument
on `Yaml.load` method. It break backword compatiblity.
see detailed discuttion: https://github.com/ruby/psych/issues/340
From: SHIBATA Hiroshi <hsbt@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61336 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Rely on encoding tags to determine if string should be dumped as binary.
8949a47b8c
* Specify "frozen_string_literal: true".
* Support to binary release for mingw32 platform.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59327 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
It contains following changes from 3.0.0.beta1
* Preserve time zone offset when deserializing times
https://github.com/ruby/psych/pull/316
* Enable YAML serialization of Ruby delegators
https://github.com/ruby/psych/pull/158
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59101 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
