dumped_railers 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 449991bfd3b66c55b2892fb55ba182ef4c6dfcfff70a5a2e91ca866b4482adfe
-  data.tar.gz: 680b841f7540bf6ff56b786109bde4212f71383ff6cb1147a156a76a832e6710
+  metadata.gz: c311dc2cc95619422567711140304a43f5e2851c1028a4c0f468b5f3ffdbe442
+  data.tar.gz: 1ea70f2788cfffda44f18433b36dd13302925f60c6894a3e628f264bc5d0161a
 SHA512:
-  metadata.gz: 8ba925ee06f3769d74e93cf20b508a01fb8cf1809792525b8f2b506c8c726187223b1b1977f015060daef6bd6fe54b309cbf64df812b143422c6133f10f3ca24
-  data.tar.gz: ba3bc362b0642c5c77b2a931ac5b32bf134ff841fd3bee868e21df1a2343b7249252f64234185664223311a2156ce87c2b679aa73975f88370ebf2795ed18dff
+  metadata.gz: cf2063fe3780b8a203d4131ed1a9d483c2497fe8ceacfa9e741358bcad6015857c404a8e4fd6ff105a63a71565cb596a447acbe6416c3dacf0def55d28b3e676
+  data.tar.gz: 0bf0d6f4ead5b7400d8dab700d3491804be5c526dbeab073569e241746029498b65bdd3c49a691ae2ad6d388d27221a507d75a3e069dc625d02d66dcf9bcbd23

data/CHANGELOG.md

@@ -62,3 +62,9 @@
 ### Changed
 - require std gems (e.g. ostruct, forwardable). Users of dumped_railers are no longer need to require them.
 - Added CI support against Ruby 3.3, 3.2, together with Rails 7.x, while dropping Ruby < 3.2, Rails < 6.1
+
+## [0.6.0]
+### Added
+- Add new options to explicitly allow specific classes for YAML import.
+### Changed
+- Accept Date, Time, DateTIme together with the classes that are set as ActiveRecord.yaml_column_permitted_classes be default.

data/README.md

@@ -175,6 +175,48 @@ DumpedRailers.import!(fixture_path, before_save: before_callback, after_save: [a
 
 `before_save` /  `after_save` can accept both single and multiple (array) arguments.
 
+### Deserializing Custom Classes with YAML
+
+* YAML (Psych) does not permit to load random class objects for [security reasons](https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017).
+* By default, DumpedRailers handles all the objects that Rails permitts (i.e. [ActiveRecord.yaml_column_permitted_classes](https://guides.rubyonrails.org/configuring.html#config-active-record-yaml-column-permitted-classes)), plus Time, Date, and DateTime.
+* DumpedRailers raises `Psych::DisallowedClass` error when non-permitted classes are detected. If you want DumpedRailsers handle other classes, you could specify `yaml_column_permitted_classes` option with configurations or import method's arguments.
+* *Please use this option with extra care* for security - again, it is recommended to use this for development purpose only.
+
+```ruby
+DumpedRailers.configure do |config|
+  config.ignorable_columns += [:published_on] # :published_on will be ignored *on top of* default settings.
+end
+```
+
+#### Caveats
+* If you wish to load Date, Time object, it would be easier to load it as a string. DumpedRailers will pass it to the specified ActiveRecord models and they typecast the raw string into the appropreate date/time object.
+
+* below columns (published_date, published_time, first_drafted_at) all will be passed as a string (as the value is surrounded by the quotes). Strings will be interperted to apropreate column type with ActiveRecord.
+
+```ruby
+_fixture:
+  model_class: Article
+  fixture_generated_by: DumpedRailers
+__article_1:
+  title: Harry Potter
+  published_date: '2024-03-01'
+  published_time: '10:00:00'
+  first_drafted_at: '2024-02-01T10:10:10+09:00'
+```
+
+* below fixture (without quotes) will be directly interperted to Date or Time via YAML module. It needs to have proper format that YAML can interpret.
+
+```ruby
+_fixture:
+  model_class: Article
+  fixture_generated_by: DumpedRailers
+__article_1:
+  title: Harry Potter
+  published_date: 2024-03-01
+  published_time: 2000-01-01 10:00:00
+  first_drafted_at: 2024-02-01T10:10:10+09:00
+```
+
 ### Configuration
 
 * All the settings can be configured by either configuration (global) or arguments (at runtime).

data/lib/dumped_railers/configuration.rb

@@ -5,7 +5,7 @@ require 'ostruct'
 module DumpedRailers
   module Configuration
     extend Forwardable
-    def_delegators :@_config, :preprocessors, :ignorable_columns, :authorized_models
+    def_delegators :@_config, :preprocessors, :ignorable_columns, :authorized_models, :yaml_column_permitted_classes
 
     def configure
       yield config
@@ -17,10 +17,20 @@ module DumpedRailers
 
     IGNORABLE_COLUMNS = %w[id created_at updated_at]
     def configure_defaults!
+      default_yaml_column_permitted_classes =
+        # FIXME: this will be no longer needed when we drop support for older Rails versions
+        # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
+        if ActiveRecord.respond_to?(:yaml_column_permitted_classes)
+          ActiveRecord.yaml_column_permitted_classes + [Date, Time, DateTime]
+        else
+          [Date, Time, DateTime]
+        end
+
       clear_configuration!(
         ignorable_columns: IGNORABLE_COLUMNS,
-        preprocessors:     [],
+        preprocessors: [],
         authorized_models: :any,
+        yaml_column_permitted_classes: default_yaml_column_permitted_classes,
       )
     end
 

data/lib/dumped_railers/file_helper.rb

@@ -5,7 +5,7 @@ require "yaml"
 module DumpedRailers
   module FileHelper
     class << self
-      def read_fixtures(*paths)
+      def read_fixtures(*paths, yaml_column_permitted_classes: [])
         yaml_files = paths.flat_map { |path|
           if File.file?(path)
             path
@@ -18,7 +18,7 @@ module DumpedRailers
 
         yaml_files.map { |file| 
           raw_data = ::File.read(file)
-          YAML.load(raw_data)
+          YAML.safe_load(raw_data, permitted_classes: yaml_column_permitted_classes)
         }
       end
 

data/lib/dumped_railers/import.rb

@@ -6,14 +6,14 @@ module DumpedRailers
   class Import
     attr_reader :fixture_set
 
-    def initialize(*paths, authorized_models: [], before_save: [], after_save: [])
+    def initialize(*paths, authorized_models: [], before_save: [], after_save: [], yaml_column_permitted_classes: [])
       @before_save =  before_save
       @after_save  =  after_save
 
       if (paths.first.is_a? Hash)
         @raw_fixtures = paths.first.values
       else
-        @raw_fixtures = FileHelper.read_fixtures(*paths)
+        @raw_fixtures = FileHelper.read_fixtures(*paths, yaml_column_permitted_classes: yaml_column_permitted_classes)
       end
 
       @fixture_set = RecordBuilder::FixtureSet.new(@raw_fixtures, authorized_models: authorized_models)

data/lib/dumped_railers/version.rb

@@ -1,3 +1,3 @@
 module DumpedRailers
-  VERSION = '0.5.0'
+  VERSION = '0.6.0'
 end

data/lib/dumped_railers.rb

@@ -24,13 +24,19 @@ module DumpedRailers
       fixtures
     end
 
-    def import!(*paths, authorized_models: nil, before_save: nil, after_save: nil)
+    def import!(*paths, authorized_models: nil, before_save: nil, after_save: nil, yaml_column_permitted_classes: [])
       # make sure class-baseed caches starts with clean state
       DumpedRailers::RecordBuilder::FixtureRow::RecordStore.clear!
       DumpedRailers::RecordBuilder::DependencyTracker.clear!
 
       # override global config settings when options are specified
-      runtime_options = { authorized_models: authorized_models.presence }.compact.reverse_merge(import_options)
+      runtime_options = 
+        {
+          authorized_models: authorized_models.presence,
+          yaml_column_permitted_classes: yaml_column_permitted_classes.presence,
+        }
+        .compact
+        .reverse_merge(import_options)
 
       before_save = Array(before_save).compact
       after_save  = Array(after_save).compact
@@ -40,6 +46,7 @@ module DumpedRailers
         authorized_models: runtime_options[:authorized_models],
         before_save: before_save,
         after_save:  after_save,
+        yaml_column_permitted_classes: runtime_options[:yaml_column_permitted_classes]
       )
       fixture_handler.import_all!
     end
@@ -55,7 +62,7 @@ module DumpedRailers
     end
 
     def import_options
-      options.slice(:authorized_models)
+      options.slice(:authorized_models, :yaml_column_permitted_classes)
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dumped_railers
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Koji Onishi
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-09-04 00:00:00.000000000 Z
+date: 2024-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler