Fix possible Unsafe Object Deserialization Vulnerability in gem owner

lib/rubygems/commands/owner_command.rb

@@ -64,7 +64,7 @@ def show_owners name
     end
 
     with_response response do |resp|
-      owners = YAML.load resp.body
+      owners = Gem::SafeYAML.load resp.body
 
       say "Owners for gem: #{name}"
       owners.each do |owner|

test/rubygems/test_gem_commands_owner_command.rb

@@ -2,6 +2,9 @@
 require 'rubygems/test_case'
 require 'rubygems/commands/owner_command'
 
+class Foo
+end
+
 class TestGemCommandsOwnerCommand < Gem::TestCase
 
   def setup
@@ -43,6 +46,31 @@ def test_show_owners
     assert_match %r{- 4}, @ui.output
   end
 
+  def test_show_owners_dont_load_objects
+    skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass)
+
+    response = <<EOF
+---
+- email: !ruby/object:Foo {}
+  id: 1
+  handle: user1
+- email: user2@example.com
+- id: 3
+  handle: user3
+- id: 4
+EOF
+
+    @fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+
+    assert_raises Psych::DisallowedClass do
+      use_ui @ui do
+        @cmd.show_owners("freewill")
+      end
+    end
+
+  end
+
+
   def test_show_owners_setting_up_host_through_env_var
     response = "- email: user1@example.com\n"
     host = "http://rubygems.example"