Loading unsafe YAMLs with YAML/Store in Psych 4

user_413924 0
Viewed 771

A recent change in Ruby's YAML Library (Psych 4) causes "unsafe" YAMLs to fail if they contain aliases, or try to instantiate unspecified classes. This is discussed in multiple places, like this StackOverflow question.

I am trying to figure out how to tell the derivative yaml/store library to allow loading unsafe YAMLs, or to provide it with my list of allowed classes.

The documentation is scarce as far as I could find, and after reading it, this is the only logical attempt I could come up with:

require 'date'
require 'yaml/store'

# 1. These options work perfectly with YAML.load_file, but not with YAML::Store
# 2. These options are not needed in Psych < 4.0
yaml_opts = { aliases: true, permitted_classes: [Time, Date, Symbol] }

store = YAML::Store.new 'log.yml', yaml_opts
data = store.transaction { store[:entries] }
p data

using this YAML file:

# log.yml
:entries:
- :timestamp: 2018-07-09 00:00:00.000000000 +03:00
  :action: Comment
  :comment: Started logging

This fails with Psych 4, and succeeds with Psych 3.

# Gemfile
source "https://rubygems.org"
gem 'psych', '>= 4.0'    # fail
# gem 'psych', '< 4.0'   # pass

As a related anecdote, the example demonstrated in the docs, also fails as-is when trying to load it with store.transaction { store["people"] }

yaml ruby
1 Answers

Although this is not the proper way of doing things, until there is a better answer, I found that adding the below code fixes the problem.

module YAML
  class << self
    alias_method :load, :unsafe_load
  end
end

This simply restores the underlying YAML::load method to its 3.x behavior of unsafe_load instead of safe_load.

In cases where my YAMLs come from a trusted source (100% of my use cases), I do not see any benefit in the new Psych 4 behavior, and feel it is ok (although awkward) to revert it.

The relevant source code reference is the 3.3.2 → 4.0.0 diff

user_4139240
Related