mirror of
https://github.com/ruby/ruby.git
synced 2026-10-28 16:36:20 +08:00
!ruby/array, !seq and !ruby/string carry the same exposure just fixed for the hash tags: the loader allocated the named class and replaced its contents without checking the class was actually an Array or String subclass. Apply the same subclass check so a permitted unrelated class can no longer be allocated and populated through these tags. https://github.com/ruby/psych/commit/73f0131b13 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
93 lines
1.9 KiB
Ruby
93 lines
1.9 KiB
Ruby
# frozen_string_literal: true
|
|
require_relative 'helper'
|
|
|
|
module Psych
|
|
class TestArray < TestCase
|
|
class X < Array
|
|
end
|
|
|
|
class Y < Array
|
|
attr_accessor :val
|
|
end
|
|
|
|
def setup
|
|
super
|
|
@list = [{ :a => 'b' }, 'foo']
|
|
end
|
|
|
|
def test_enumerator
|
|
x = [1, 2, 3, 4]
|
|
y = Psych.load Psych.dump x.to_enum
|
|
assert_equal x, y
|
|
end
|
|
|
|
def test_another_subclass_with_attributes
|
|
y = Y.new.tap {|o| o.val = 1}
|
|
y << "foo" << "bar"
|
|
y = Psych.unsafe_load Psych.dump y
|
|
|
|
assert_equal %w{foo bar}, y
|
|
assert_equal Y, y.class
|
|
assert_equal 1, y.val
|
|
end
|
|
|
|
def test_subclass
|
|
yaml = Psych.dump X.new
|
|
assert_match X.name, yaml
|
|
|
|
list = X.new
|
|
list << 1
|
|
assert_equal X, list.class
|
|
assert_equal 1, list.first
|
|
end
|
|
|
|
def test_subclass_with_attributes
|
|
y = Psych.unsafe_load Psych.dump Y.new.tap {|o| o.val = 1}
|
|
assert_equal Y, y.class
|
|
assert_equal 1, y.val
|
|
end
|
|
|
|
def test_backwards_with_syck
|
|
x = Psych.unsafe_load "--- !seq:#{X.name} []\n\n"
|
|
assert_equal X, x.class
|
|
end
|
|
|
|
class NotAnArray
|
|
end
|
|
|
|
def test_seq_tag_rejects_non_array_class
|
|
assert_raise(ArgumentError) do
|
|
Psych.unsafe_load "--- !seq:#{NotAnArray} []\n"
|
|
end
|
|
assert_raise(ArgumentError) do
|
|
Psych.unsafe_load "--- !ruby/array:#{NotAnArray} []\n"
|
|
end
|
|
end
|
|
|
|
def test_self_referential
|
|
@list << @list
|
|
assert_cycle(@list)
|
|
end
|
|
|
|
def test_recursive_array
|
|
@list << @list
|
|
|
|
loaded = Psych.load(Psych.dump(@list), aliases: true)
|
|
|
|
assert_same loaded, loaded.last
|
|
end
|
|
|
|
def test_recursive_array_uses_alias
|
|
@list << @list
|
|
|
|
assert_raise(AliasesNotEnabled) do
|
|
Psych.load(Psych.dump(@list), aliases: false)
|
|
end
|
|
end
|
|
|
|
def test_cycle
|
|
assert_cycle(@list)
|
|
end
|
|
end
|
|
end
|