Parse YAML safely (#157)

Gemfile

@@ -9,6 +9,7 @@ gem 'rack-cache', '>= 1.1', '< 1.3'
 gem 'rake', '>= 0.9', '< 11'
 gem 'rash_alt', '>= 0.4.3'
 gem 'simple_oauth', '>= 0.1', '< 0.3'
+gem 'safe_yaml'
 
 group :test do
   gem 'cane', '>= 2.2.2', :platforms => [:mri_19, :mri_20, :mri_21]

lib/faraday_middleware/response/parse_yaml.rb

@@ -3,27 +3,31 @@
 module FaradayMiddleware
   # Public: Parse response bodies as YAML.
   #
-  # Warning: this uses `YAML.load()` by default and as such is not safe against
-  # code injection or DoS attacks. If you're loading resources from an
-  # untrusted host or over HTTP, you should subclass this middleware and
-  # redefine it to use `safe_load()` if you're using a Psych version that
-  # supports it:
+  # Warning: This is not backwards compatible with versions of this middleware prior to
+  # faraday_middleware v0.12 - prior to this version, we used YAML.load rather than
+  # YAMl.safe_load, which exposes serious remote code execution risks - see
+  # https://github.com/ruby/psych/issues/119 for details. If you're sure you can trust
+  # YAML you're passing, you can set up an unsafe version of this middleware as follows:
+  #
+  #     class UnsafelyParseYaml < FaradayMiddleware::ResponseMiddleware
+  #       dependency do
+  #         require 'yaml'
+  #       end
   #
-  #     class SafeYaml < FaradayMiddleware::ParseYaml
   #       define_parser do |body|
-  #         YAML.safe_load(body)
+  #         YAML.load body
   #       end
   #     end
   #
   #     Faraday.new(..) do |config|
-  #       config.use SafeYaml
+  #       config.use UnsafelyParseYaml
   #       ...
   #     end
   class ParseYaml < ResponseMiddleware
-    dependency 'yaml'
+    dependency 'safe_yaml/load'
 
     define_parser do |body|
-      ::YAML.load body
+      SafeYAML.load body
     end
   end
 end