Files
ruby/test/psych/test_array.rb
Hiroshi SHIBATAandClaude Opus 4.8 422347ea26 [ruby/psych] Reject non-Array/String classes for their subclass tags
!ruby/array, !seq and !ruby/string carry the same exposure just fixed
for the hash tags: the loader allocated the named class and replaced its
contents without checking the class was actually an Array or String
subclass. Apply the same subclass check so a permitted unrelated class
can no longer be allocated and populated through these tags.

https://github.com/ruby/psych/commit/73f0131b13

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-09 00:04:14 +00:00

93 lines
1.9 KiB
Ruby

# frozen_string_literal: true
require_relative 'helper'
module Psych
class TestArray < TestCase
class X < Array
end
class Y < Array
attr_accessor :val
end
def setup
super
@list = [{ :a => 'b' }, 'foo']
end
def test_enumerator
x = [1, 2, 3, 4]
y = Psych.load Psych.dump x.to_enum
assert_equal x, y
end
def test_another_subclass_with_attributes
y = Y.new.tap {|o| o.val = 1}
y << "foo" << "bar"
y = Psych.unsafe_load Psych.dump y
assert_equal %w{foo bar}, y
assert_equal Y, y.class
assert_equal 1, y.val
end
def test_subclass
yaml = Psych.dump X.new
assert_match X.name, yaml
list = X.new
list << 1
assert_equal X, list.class
assert_equal 1, list.first
end
def test_subclass_with_attributes
y = Psych.unsafe_load Psych.dump Y.new.tap {|o| o.val = 1}
assert_equal Y, y.class
assert_equal 1, y.val
end
def test_backwards_with_syck
x = Psych.unsafe_load "--- !seq:#{X.name} []\n\n"
assert_equal X, x.class
end
class NotAnArray
end
def test_seq_tag_rejects_non_array_class
assert_raise(ArgumentError) do
Psych.unsafe_load "--- !seq:#{NotAnArray} []\n"
end
assert_raise(ArgumentError) do
Psych.unsafe_load "--- !ruby/array:#{NotAnArray} []\n"
end
end
def test_self_referential
@list << @list
assert_cycle(@list)
end
def test_recursive_array
@list << @list
loaded = Psych.load(Psych.dump(@list), aliases: true)
assert_same loaded, loaded.last
end
def test_recursive_array_uses_alias
@list << @list
assert_raise(AliasesNotEnabled) do
Psych.load(Psych.dump(@list), aliases: false)
end
end
def test_cycle
assert_cycle(@list)
end
end
end