dumped_railers 0.4.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ad9f2b4ac74c2d926442a9292907bf0201cfe2dc01f48e6a1c115514360b730a
-  data.tar.gz: 515e61e954e02489ae21218f121e593389d1f1602ad5c532fcc53e02ae112237
+  metadata.gz: c311dc2cc95619422567711140304a43f5e2851c1028a4c0f468b5f3ffdbe442
+  data.tar.gz: 1ea70f2788cfffda44f18433b36dd13302925f60c6894a3e628f264bc5d0161a
 SHA512:
-  metadata.gz: 0fd8c272b5c0f630bc08ec446ada9d1bdb96eeeb353d3c1bd20df515e045a157508070eba600fbcf3e927c804a2fe4e1b18307210d19067f961eeeaa26729a83
-  data.tar.gz: adf932812767e149015efafc1007ba069f88001304601538046146137abe4ab9aa3c686948140e122713237221f68b73f085367a06b49bfcbd162585aa0d880f
+  metadata.gz: cf2063fe3780b8a203d4131ed1a9d483c2497fe8ceacfa9e741358bcad6015857c404a8e4fd6ff105a63a71565cb596a447acbe6416c3dacf0def55d28b3e676
+  data.tar.gz: 0bf0d6f4ead5b7400d8dab700d3491804be5c526dbeab073569e241746029498b65bdd3c49a691ae2ad6d388d27221a507d75a3e069dc625d02d66dcf9bcbd23

data/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        ruby_version: ['3.3', '3.2']
+        rails_version: ['7.2', '7.1', '7.0', '6.1']
+    env:
+      BUNDLE_GEMFILE: gemfiles/Gemfile.rails_${{ matrix.rails_version }}
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby_version }}
+          bundler-cache: true
+          rubygems: 'latest'
+      - run: bundle exec rake spec

data/CHANGELOG.md

@@ -54,3 +54,17 @@
   - Preprocessors now require arguments (`model`, `attributes`) in this order. Before version < 0.4, it was (`attributes`, `model`)
   - Attributes needs to be updated destructively within preprocessors. Return values are no longer required reflect the changes.
 
+## [0.4.1]
+### Fixed
+- Run all the `before` callbacks before any of the record import starts, `after` callbacks after all the import.
+
+## [0.5.0]
+### Changed
+- require std gems (e.g. ostruct, forwardable). Users of dumped_railers are no longer need to require them.
+- Added CI support against Ruby 3.3, 3.2, together with Rails 7.x, while dropping Ruby < 3.2, Rails < 6.1
+
+## [0.6.0]
+### Added
+- Add new options to explicitly allow specific classes for YAML import.
+### Changed
+- Accept Date, Time, DateTIme together with the classes that are set as ActiveRecord.yaml_column_permitted_classes be default.

data/README.md

@@ -1,5 +1,5 @@
 # DumpedRailers    <img src='https://user-images.githubusercontent.com/23026542/101830310-aaf10000-3b77-11eb-9e0a-d14e45b27760.png' width=40>
-[![Build Status](https://travis-ci.com/fursich/dumped_railers.svg?branch=main)](https://travis-ci.com/fursich/dumped_railers) [![Gem Version](https://badge.fury.io/rb/dumped_railers.svg)](https://badge.fury.io/rb/dumped_railers)
+[![Build Status](https://github.com/fursich/dumped_railers/actions/workflows/ci.yml/badge.svg)](https://github.com/fursich/dumped_railers/actions/workflows/ci.yml/badge.svg) [![Gem Version](https://badge.fury.io/rb/dumped_railers.svg)](https://badge.fury.io/rb/dumped_railers)
 
 Helping you take a snapshot of ActiveRecord models in Rails-compatible fixture format, and re-importing them wherever necessary without destroying current data you have.
 
@@ -175,6 +175,48 @@ DumpedRailers.import!(fixture_path, before_save: before_callback, after_save: [a
 
 `before_save` /  `after_save` can accept both single and multiple (array) arguments.
 
+### Deserializing Custom Classes with YAML
+
+* YAML (Psych) does not permit to load random class objects for [security reasons](https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017).
+* By default, DumpedRailers handles all the objects that Rails permitts (i.e. [ActiveRecord.yaml_column_permitted_classes](https://guides.rubyonrails.org/configuring.html#config-active-record-yaml-column-permitted-classes)), plus Time, Date, and DateTime.
+* DumpedRailers raises `Psych::DisallowedClass` error when non-permitted classes are detected. If you want DumpedRailsers handle other classes, you could specify `yaml_column_permitted_classes` option with configurations or import method's arguments.
+* *Please use this option with extra care* for security - again, it is recommended to use this for development purpose only.
+
+```ruby
+DumpedRailers.configure do |config|
+  config.ignorable_columns += [:published_on] # :published_on will be ignored *on top of* default settings.
+end
+```
+
+#### Caveats
+* If you wish to load Date, Time object, it would be easier to load it as a string. DumpedRailers will pass it to the specified ActiveRecord models and they typecast the raw string into the appropreate date/time object.
+
+* below columns (published_date, published_time, first_drafted_at) all will be passed as a string (as the value is surrounded by the quotes). Strings will be interperted to apropreate column type with ActiveRecord.
+
+```ruby
+_fixture:
+  model_class: Article
+  fixture_generated_by: DumpedRailers
+__article_1:
+  title: Harry Potter
+  published_date: '2024-03-01'
+  published_time: '10:00:00'
+  first_drafted_at: '2024-02-01T10:10:10+09:00'
+```
+
+* below fixture (without quotes) will be directly interperted to Date or Time via YAML module. It needs to have proper format that YAML can interpret.
+
+```ruby
+_fixture:
+  model_class: Article
+  fixture_generated_by: DumpedRailers
+__article_1:
+  title: Harry Potter
+  published_date: 2024-03-01
+  published_time: 2000-01-01 10:00:00
+  first_drafted_at: 2024-02-01T10:10:10+09:00
+```
+
 ### Configuration
 
 * All the settings can be configured by either configuration (global) or arguments (at runtime).

data/dumped_railers.gemspec

@@ -26,11 +26,11 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_development_dependency 'bundler', '~> 2.0'
-  spec.add_development_dependency 'rake', '~> 12.3.3'
-  spec.add_development_dependency 'rspec', '~> 3.10'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'rspec'
   spec.add_development_dependency 'sqlite3'
-  spec.add_development_dependency 'activerecord', '>= 5.2'
-  spec.add_development_dependency 'database_cleaner-active_record', '~> 1.8'
+  spec.add_development_dependency 'activerecord'
+  spec.add_development_dependency 'database_cleaner-active_record', '~> 2.0'
   spec.add_development_dependency 'pry'
   spec.add_development_dependency 'pry-byebug'
   spec.add_development_dependency 'pry-doc'

data/gemfiles/Gemfile.rails_6.1

@@ -1,6 +1,7 @@
-source "https://rubygems.org"
+source 'https://rubygems.org'
 
 # Specify your gem's dependencies in dumped_railers.gemspec
-gem 'activerecord', '6.1.1'
+gem 'activerecord', '6.1.7'
+gem 'sqlite3', '~> 1.5'
 
 gemspec path: '../'

data/gemfiles/{Gemfile.rails_5.2 → Gemfile.rails_7.0}

@@ -1,6 +1,7 @@
-source "https://rubygems.org"
+source 'https://rubygems.org'
 
 # Specify your gem's dependencies in dumped_railers.gemspec
-gem 'activerecord', '5.2.4.4'
+gem 'activerecord', '7.0.8'
+gem 'sqlite3', '~> 1.7'
 
 gemspec path: '../'

data/gemfiles/Gemfile.rails_7.1

@@ -0,0 +1,7 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in dumped_railers.gemspec
+gem 'activerecord', '~> 7.1.0'
+gem 'sqlite3', '~> 1.7'
+
+gemspec path: '../'

data/gemfiles/{Gemfile.rails_6.0 → Gemfile.rails_7.2}

@@ -1,6 +1,7 @@
-source "https://rubygems.org"
+source 'https://rubygems.org'
 
 # Specify your gem's dependencies in dumped_railers.gemspec
-gem 'activerecord', '6.0.3.4'
+gem 'activerecord', '7.2.1'
+gem 'sqlite3', '~> 1.7'
 
 gemspec path: '../'

data/lib/dumped_railers/configuration.rb

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+require 'forwardable'
+require 'ostruct'
 module DumpedRailers
   module Configuration
     extend Forwardable
-    def_delegators :@_config, :preprocessors, :ignorable_columns, :authorized_models
+    def_delegators :@_config, :preprocessors, :ignorable_columns, :authorized_models, :yaml_column_permitted_classes
 
     def configure
       yield config
@@ -15,10 +17,20 @@ module DumpedRailers
 
     IGNORABLE_COLUMNS = %w[id created_at updated_at]
     def configure_defaults!
+      default_yaml_column_permitted_classes =
+        # FIXME: this will be no longer needed when we drop support for older Rails versions
+        # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
+        if ActiveRecord.respond_to?(:yaml_column_permitted_classes)
+          ActiveRecord.yaml_column_permitted_classes + [Date, Time, DateTime]
+        else
+          [Date, Time, DateTime]
+        end
+
       clear_configuration!(
         ignorable_columns: IGNORABLE_COLUMNS,
-        preprocessors:     [],
+        preprocessors: [],
         authorized_models: :any,
+        yaml_column_permitted_classes: default_yaml_column_permitted_classes,
       )
     end
 

data/lib/dumped_railers/file_helper.rb

@@ -5,7 +5,7 @@ require "yaml"
 module DumpedRailers
   module FileHelper
     class << self
-      def read_fixtures(*paths)
+      def read_fixtures(*paths, yaml_column_permitted_classes: [])
         yaml_files = paths.flat_map { |path|
           if File.file?(path)
             path
@@ -18,7 +18,7 @@ module DumpedRailers
 
         yaml_files.map { |file| 
           raw_data = ::File.read(file)
-          YAML.load(raw_data)
+          YAML.safe_load(raw_data, permitted_classes: yaml_column_permitted_classes)
         }
       end
 

data/lib/dumped_railers/import.rb

@@ -6,14 +6,14 @@ module DumpedRailers
   class Import
     attr_reader :fixture_set
 
-    def initialize(*paths, authorized_models: [], before_save: [], after_save: [])
+    def initialize(*paths, authorized_models: [], before_save: [], after_save: [], yaml_column_permitted_classes: [])
       @before_save =  before_save
       @after_save  =  after_save
 
       if (paths.first.is_a? Hash)
         @raw_fixtures = paths.first.values
       else
-        @raw_fixtures = FileHelper.read_fixtures(*paths)
+        @raw_fixtures = FileHelper.read_fixtures(*paths, yaml_column_permitted_classes: yaml_column_permitted_classes)
       end
 
       @fixture_set = RecordBuilder::FixtureSet.new(@raw_fixtures, authorized_models: authorized_models)

data/lib/dumped_railers/version.rb

@@ -1,3 +1,3 @@
 module DumpedRailers
-  VERSION = '0.4.1'
+  VERSION = '0.6.0'
 end

data/lib/dumped_railers.rb

@@ -24,13 +24,19 @@ module DumpedRailers
       fixtures
     end
 
-    def import!(*paths, authorized_models: nil, before_save: nil, after_save: nil)
+    def import!(*paths, authorized_models: nil, before_save: nil, after_save: nil, yaml_column_permitted_classes: [])
       # make sure class-baseed caches starts with clean state
       DumpedRailers::RecordBuilder::FixtureRow::RecordStore.clear!
       DumpedRailers::RecordBuilder::DependencyTracker.clear!
 
       # override global config settings when options are specified
-      runtime_options = { authorized_models: authorized_models.presence }.compact.reverse_merge(import_options)
+      runtime_options = 
+        {
+          authorized_models: authorized_models.presence,
+          yaml_column_permitted_classes: yaml_column_permitted_classes.presence,
+        }
+        .compact
+        .reverse_merge(import_options)
 
       before_save = Array(before_save).compact
       after_save  = Array(after_save).compact
@@ -40,6 +46,7 @@ module DumpedRailers
         authorized_models: runtime_options[:authorized_models],
         before_save: before_save,
         after_save:  after_save,
+        yaml_column_permitted_classes: runtime_options[:yaml_column_permitted_classes]
       )
       fixture_handler.import_all!
     end
@@ -55,7 +62,7 @@ module DumpedRailers
     end
 
     def import_options
-      options.slice(:authorized_models)
+      options.slice(:authorized_models, :yaml_column_permitted_classes)
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dumped_railers
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.6.0
 platform: ruby
 authors:
 - Koji Onishi
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-01-25 00:00:00.000000000 Z
+date: 2024-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -28,30 +28,30 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 12.3.3
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 12.3.3
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.10'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.10'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -72,28 +72,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.2'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.2'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: database_cleaner-active_record
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.8'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
@@ -145,9 +145,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
 - CHANGELOG.md
 - Gemfile
 - LICENSE.txt
@@ -156,9 +156,10 @@ files:
 - bin/console
 - bin/setup
 - dumped_railers.gemspec
-- gemfiles/Gemfile.rails_5.2
-- gemfiles/Gemfile.rails_6.0
 - gemfiles/Gemfile.rails_6.1
+- gemfiles/Gemfile.rails_7.0
+- gemfiles/Gemfile.rails_7.1
+- gemfiles/Gemfile.rails_7.2
 - lib/dumped_railers.rb
 - lib/dumped_railers/configuration.rb
 - lib/dumped_railers/dump.rb
@@ -179,7 +180,7 @@ metadata:
   homepage_uri: https://github.com/fursich/dumped_railers
   source_code_uri: https://github.com/fursich/dumped_railers
   changelog_uri: https://github.com/fursich/dumped_railers/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -194,8 +195,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.5.11
+signing_key:
 specification_version: 4
 summary: A flexible fixture importer/exporter, that can transport ActiveRecord data
   in fixture format

data/.travis.yml

@@ -1,17 +0,0 @@
----
-language: ruby
-cache: bundler
-before_install: gem install bundler
-rvm:
-  - 3.0.0
-  - 2.7.2
-  - 2.6.6
-  - 2.5.8
-gemfile:
-  - gemfiles/Gemfile.rails_6.1
-  - gemfiles/Gemfile.rails_6.0
-  - gemfiles/Gemfile.rails_5.2
-jobs:
-  exclude:
-    - rvm: 3.0.0
-      gemfile: gemfiles/Gemfile.rails_5.2