mirror of
https://github.com/ruby/ruby.git
synced 2026-08-05 23:40:42 +08:00
422347ea26
!ruby/array, !seq and !ruby/string carry the same exposure just fixed for the hash tags: the loader allocated the named class and replaced its contents without checking the class was actually an Array or String subclass. Apply the same subclass check so a permitted unrelated class can no longer be allocated and populated through these tags. https://github.com/ruby/psych/commit/73f0131b13 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>