When upgrading to Rails 6.1.6.1, I started getting the following error in the application:
Psych::DisallowedClass:
Tried to load unspecified class: Symbol
This is being caused by using the Hash serializer on an ActiveRecord column, which uses Symbols as keys or values:
serialize :parameters, Hash
The error occurs due to the following security update in Rails: https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
The Hash serializer apparently loaded data with YAML.unsafe_load, which now changed to YAML.safe_load. This new method does not handle data types such as Symbol or Time by default for security reasons.
The workaround as the announcement suggests is to either migrate the serializer to JSON or use only safe data types in the serialization (Strings, Numbers).
However, there are two configurable quick workarounds though:
config.active_record.use_yaml_unsafe_load
This is not recommended as it basically reverts back to the old behaviour.
OR
config.active_record.yaml_column_permitted_classes = [Symbol]
Which allows serializing Symbols or other unsupported (or unsafe) data types.
In case anybody else gets stuck on this, none of the two fixes suggested above and in the Rails security update worked for me on Rails 5.2.8.1, I kept having the same error (Tried to load unspecified class: Symbol) despite allowing it with config.active_record.yaml_column_permitted_classes = [Symbol] in application.rb.
In the end I had to adjust the unsafe_load option as per @ryan2johnson9's first comment for it to work:
config.active_record.use_yaml_unsafe_load = true