This issue was moved to a discussion.
You can continue the conversation there. Go to discussion →
Breaking change with Yaml.safe_load
#533
Comments
|
It's not only about # file: test.rb
require "yaml"
puts "RUBY: #{RUBY_VERSION}"
puts "PSYCH: #{Psych::VERSION}"
puts "LIBYAML: #{Psych::LIBYAML_VERSION}"
source = <<~YAML
foo: &foo
a: 1
b: 2
bar:
<<: *foo
a: 2
YAML
puts YAML.load(source) |
|
Ran into this issue when devise_ldap_authenticatable attempted to parse a LDAP YAML config file that is almost identical to @poloka's original example. It looks like Lines 369 to 376 in ba203f1 Based on a quick glance, it looks like this commit 1764942 8 months ago by @tenderlove is when this behavior was introduced. I'm currently working around this by removing the anchor and aliases and manually duplicating some config. I'm still kinda new to the Ruby software ecosystem, but this seems particularly annoying since most users of Psych don't pull it in as a gem and thus don't explicitly vendor it in their Gemfiles. |
|
@colemannugent if the YAML documents you're loading are trusted (IOW can't be controlled by external users) you can use |
|
@tenderlove In this case I'm not calling Psych directly. I ran into this issue when a gem I use (devise_ldap_authenticatable) attempted to parse a YAML config file that I used anchors and aliases in to avoid repetition. It looks like the way to resolve this is to alert most downstream users of Psych that they'll have examine where they load YAML and determine if it's safe to use |
|
FWIW - A contributor to this situation is an update to |
|
I also ran into this from a github dependabot upgrade of rdoc. (sdoc -> rdoc -> psych) |
Psych (aka YAML) 4.x included a breaking change to how `YAML.load` works In Psych 4.0, `load` calls `safe_load` under the hood, and is therefore "safe" by default, but that breaks configurations that support (among other things) aliases, which are disabled when using "safe" loading. `unsafe_load` is now the canonical way to load trusted documents (i.e., config files): ruby/psych#533 (comment) To ensure maximum compatibility with old versions of Psych, we also need to set a minimum version of Psych to ensure `unsafe_load` is defined. The methods were introduced in v3.3.2: ruby/psych@cb50aa8 Resolves #116
Psych (aka YAML) 4.x included a breaking change to how `YAML.load` works In Psych 4.0, `load` calls `safe_load` under the hood, and is therefore "safe" by default, but that breaks configurations that support (among other things) aliases, which are disabled when using "safe" loading. `unsafe_load` is now the canonical way to load trusted documents (i.e., config files): ruby/psych#533 (comment) To ensure maximum compatibility with old versions of Psych, we also need to set a minimum version of Psych to ensure `unsafe_load` is defined. The methods were introduced in v3.3.2: ruby/psych@cb50aa8 Resolves #60
Psych (aka YAML) 4.x included a breaking change to how `YAML.load` works In Psych 4.0, `load` calls `safe_load` under the hood, and is therefore "safe" by default, but that breaks configurations that support (among other things) aliases, which are disabled when using "safe" loading. `unsafe_load` is now the canonical way to load trusted documents (i.e., config files): ruby/psych#533 (comment) To ensure maximum compatibility with old versions of Psych, we also need to set a minimum version of Psych to ensure `unsafe_load` is defined. The methods were introduced in v3.3.2: ruby/psych@cb50aa8 Resolves #60
@dgm I also ran into this issue. Please guide if there is any solution. |
|
This change breaks facter "custom facts" in production. Please guide if there is any solution. |
|
Hi is there any solution, Even I am facing similar kind of issue. Which is working fine locally but failing at Jenkins when running in a container. |
This issue was moved to a discussion.
You can continue the conversation there. Go to discussion →
Issue
It looks like psych-4.x included a breaking change to how
YAML.safe_loadexecutes causing awrong number of argumentserror when using the old format for performing asafe_load. Take specific note of the differences in the following output on the testing ofTesting 'YAML.safe_load' with options: ([], [], true) using psych-3.3.2 on 2.6.6vsTesting 'YAML.safe_load' with options: ([], [], true) using psych-4.0.3 on 2.6.6.Investigation
Using the following code:
Loading the following file:
Ruby 2.6 with psych-3.3.2 output
Ruby 2.6 with psych-4.0.3 output
The text was updated successfully, but these errors were encountered: