Any way to pass in allowed classes so the YAML.load deserialize things saved before the Active Record update?

[gpinkham]

this CVE causes an update to Active Record and Psych and now our previously serialized values with a Time in them can't be deserialized. The fix is to tell YAML.load which classes are allowed but that's not available to us thru the settings gem. Curious if others are experiencing this today? Any work arounds?

[gpinkham]

forgot to past the CVE. https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017

[ledermann]

I have added this to application.rb of my app and it works fine:

config.active_record.yaml_column_permitted_classes = [
  Symbol,
  Date,
  Time,
  # + some custom classes
]

[gpinkham]

Thanks for the info!