Support for Psych version 4

[niciliketo]

I think Psych 4 uses safe_load by default

ruby/psych#487

This seems to cause a problem when retrieving previous versions with papertrail
Check the following boxes:

• This is not a usage question, this is a bug report
• This bug can be reproduced with the script I provide below
• This bug can be reproduced in the latest release of the paper_trail gem

Due to limited volunteers, we cannot answer usage questions. Please ask such
questions on StackOverflow.

Bug reports must use the following template:

# frozen_string_literal: true

# Use this template to report PaperTrail bugs.
# Please include only the minimum code necessary to reproduce your issue.
require "bundler/inline"

# STEP ONE: What versions are you using?
gemfile(true) do
  ruby "2.7.4"
  source "https://rubygems.org"
  gem "activerecord", "6.1.0"
  gem "minitest", "5.11.3"
  #gem "psych", ">=3", "<4"
  gem "psych", ">=4"
  gem "paper_trail", ">=12", require: false
  gem "sqlite3",  "1.4.2"
end

require "active_record"
require "minitest/autorun"
require "logger"

# Please use sqlite for your bug reports, if possible.
ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
ActiveRecord::Base.logger = nil
ActiveRecord::Schema.define do
  # STEP TWO: Define your tables here.
  create_table :users, force: true do |t|
    t.text :first_name, null: false
    t.timestamps null: false
  end

  create_table :versions do |t|
    t.string :item_type, null: false
    t.integer :item_id, null: false
    t.string :event, null: false
    t.string :whodunnit
    t.text :object, limit: 1_073_741_823
    t.text :object_changes, limit: 1_073_741_823
    t.datetime :created_at
  end
  add_index :versions, %i[item_type item_id]
end
ActiveRecord::Base.logger = Logger.new(STDOUT)
require "paper_trail"

# STEP FOUR: Define your AR models here.
class User < ActiveRecord::Base
  has_paper_trail
end

# STEP FIVE: Please write a test that demonstrates your issue.
class BugTest < ActiveSupport::TestCase
  def test_1
    assert_nothing_raised {
      u = User.create(first_name: "Jane")
      u.first_name = "John"
      u.save
      u.paper_trail.previous_version
    }
  end
end


# STEP SIX: Run this script using `ruby my_bug_report.rb`

[gurgelrenan]

Hi @niciliketo, thanks for share the issue. I could reproduce and seems like could be an easy fix.

In lib/paper_trail/serializers/yaml.rb:12 if we replace

::YAML.load string

by

::YAML.respond_to?(:unsafe_load) ? ::YAML.unsafe_load(string) : ::YAML.load(string)

It works. I just used the same code that rails team used here: rails/rails@255b5ff

I would like to see @jaredbeck thoughts.

[jaredbeck]

Sounds good, thanks @gurgelrenan