| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
In future versions of Psych, the `load` method will be mostly the same
as the `safe_load` method. In other words, the `load` method won't
allow arbitrary object deserialization (which can be used to escalate to
an RCE). People that need to load *trusted* documents can use the
`unsafe_load` method.
This commit introduces the `unsafe_load` method so that people can
incrementally upgrade. For example, if they try to upgrade to 4.0.0 and
something breaks, they can downgrade, audit callsites, change to
`safe_load` or `unsafe_load` as required, and then upgrade to 4.0.0
smoothly.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The only remaining use of this function was to get the internal
message object from an exception's hidden `mesg` instance
variable to allow it to be dumped wiithout converting to a string.
As discussed in #103, this exposes internal implementation details
of CRuby, and ultimately does not provide any real utility to the
user since they can't directly inspect this hidden variable. The
test change here is to reflect CRuby behavior that denies equality
if the internal message objects do not match, as is the case after
the exception has been loaded and now has a simple String value.
The impact to users is that exceptions with special hidden message
objects will convert those objects to String during marshaling
through YAML. I believe this only affects NameError and its
descendants, since users can't set this field directly on their
own exception types.
Fixes #103.
|
| |
|
|
| |
This commit allows exception backtraces to round trip
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
ref. https://github.com/ruby/ruby/commit/3e92b635fb5422207b7bbdc924e292e51e21f040
|
| |
|
|
|
|
|
| |
loading. Fixes GH #85. Thanks @brentdax for the patch!
* test/psych/test_exception.rb: test for fix
fixes #85
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
Previously Psych::SyntaxError inherited from SyntaxError. Since
SyntaxError does not inherit from StandardError a plain rescue could not
capture a YAML parse error. This made code that needed to handle psych
errors slightly more complex.
Psych::SyntaxError now inherits from Psych::Error (allowing room for
future expansion of psych errors that can be caught under the same
umbrella) and inherits from RuntimeError.
|
| |
|
|
|
|
|
|
| |
an optional file name that is used when raising Psych::SyntaxError
exceptions
* ext/psych/lib/psych/syntax_error.rb (module Psych): allow nil file
names and handle nil file names in the exception message
* test/psych/test_exception.rb (module Psych): Tests for changes.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
