unsafe_load secrets.yml with psych 4

rails · Jul 3, 2021 · 0ebb708 · 0ebb708
1 parent 56d8ff8
commit 0ebb708
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/railties/lib/rails/secrets.rb b/railties/lib/rails/secrets.rb
@@ -25,7 +25,10 @@ def parse(paths, env:)
         paths.each_with_object(Hash.new) do |path, all_secrets|
           require "erb"
 
-          secrets = YAML.load(ERB.new(preprocess(path)).result) || {}
+          source = ERB.new(preprocess(path)).result
+          secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(source) : YAML.load(source)
+          secrets ||= {}
+
           all_secrets.merge!(secrets["shared"].deep_symbolize_keys) if secrets["shared"]
           all_secrets.merge!(secrets[env].deep_symbolize_keys) if secrets[env]
         end