Skip to content

Commit 592a75a

Browse files
committed
Fix RestrictedYAMLTree allowing the Symbol class should allow all symbols
Ref: #495 That's how it works for `safe_load`: ```ruby >> YAML.safe_load(':foo', permitted_classes: [Symbol]) => :foo ``` So `safe_dump` should mirror that.
1 parent 2d472f5 commit 592a75a

File tree

2 files changed

+7
-4
lines changed

2 files changed

+7
-4
lines changed

lib/psych/visitors/yaml_tree.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -568,15 +568,15 @@ def accept target
568568
raise BadAlias, "Tried to dump an aliased object"
569569
end
570570

571-
unless @permitted_classes[target.class]
571+
unless Symbol === target || @permitted_classes[target.class]
572572
raise DisallowedClass.new('dump', target.class.name || target.class.inspect)
573573
end
574574

575575
super
576576
end
577577

578578
def visit_Symbol sym
579-
unless @permitted_symbols[sym]
579+
unless @permitted_classes[Symbol] || @permitted_symbols[sym]
580580
raise DisallowedClass.new('dump', "Symbol(#{sym.inspect})")
581581
end
582582

test/psych/test_psych.rb

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -419,12 +419,15 @@ def test_safe_dump_extra_permitted_classes
419419
end
420420

421421
def test_safe_dump_symbols
422+
assert_equal Psych.dump(:foo), Psych.safe_dump(:foo, permitted_classes: [Symbol])
423+
assert_equal Psych.dump(:foo), Psych.safe_dump(:foo, permitted_symbols: [:foo])
424+
422425
error = assert_raise Psych::DisallowedClass do
423-
Psych.safe_dump(:foo, permitted_classes: [Symbol])
426+
Psych.safe_dump(:foo)
424427
end
425428
assert_equal "Tried to dump unspecified class: Symbol(:foo)", error.message
426429

427-
assert_match(/\A--- :foo\n(?:\.\.\.\n)?\z/, Psych.safe_dump(:foo, permitted_classes: [Symbol], permitted_symbols: [:foo]))
430+
assert_match(/\A--- :foo\n(?:\.\.\.\n)?\z/, Psych.safe_dump(:foo, permitted_symbols: [:foo]))
428431
end
429432

430433
def test_safe_dump_aliases

0 commit comments

Comments
 (0)