firm 0.9.3 → 0.9.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c1c7b999e2db422d608d8aaf8e28a9bace6824640f50a8e5dabb30e2ca89a36
-  data.tar.gz: a16d62247a09cc2e1d8b3c4d2a990ffefb7b48c18f6f1d8f27e12c770ff103eb
+  metadata.gz: be22317c4039737f9407836be331ea1b4c84750ba86404982e824079bbf712d2
+  data.tar.gz: '018828f0e65cdedc6532e7bc0114e2ba08b714ef819f4abd5c5423b1cf2e1b55'
 SHA512:
-  metadata.gz: 6c45a0bc530a143ad8b37de7e00f6fdd4a2af91ffb52b18ce86f91ffac390ea05825d58b042e29361a96fd762be58d210d141bdb88d9748c3232e7c30232b8cc
-  data.tar.gz: 939fe265f4f55f1255851e5f246b73ca416c6649af2ffcdad6aa8fb63341289ef64c71678bc02a7372c66acd6a91a26111ebc049d2a571b5f3f189f7010d3fb2
+  metadata.gz: cc7caa8558e867da5c810c8697e5c75781656a9de62b60bfd950a11ec07da24c47343979dbc392970f51e9186b9b26bc5fb7396efe6826191bed79bf3e404a5d
+  data.tar.gz: 58e1c3e781c8862c46f16f2ca97f66af1658a81334b306b98def70c56e3f7a39abfcb3d3ca39562e1443024c952d7118061cdd2053bab1bd69f6d768b55fd246

data/README.md

@@ -43,6 +43,10 @@ FIRM supports (de-)serializing many core Ruby objects out of the box including:
 - `Date`
 - `DateTime`
 
+For security reasons FIRM does **not** support direct (de-)serializing of `Class` objects but will rather
+serialize (and deserialize) these as their scoped string names. Customized property setters can be used to
+resolve Class objects from these names if really needed.
+
 FIRM also supports a simple scheme to provide (de-)serialization support for user defined classes. 
 
 FIRM provides object aliasing support for JSON and XML in a similar fashion as the standard support provided

data/lib/firm/serializable.rb

@@ -143,6 +143,12 @@ module FIRM
 
     class << self
 
+      TLS_VARS_KEY = :firm_tls_vars.freeze
+
+      def tls_vars
+        Thread.current[TLS_VARS_KEY] ||= {}
+      end
+
       def serializables
         @serializables ||= ::Set.new
       end
@@ -198,7 +204,7 @@ module FIRM
       private_constant :TLS_ALIAS_STACK_KEY
 
       def anchor_object_registry_stack
-        ::Thread.current[TLS_ANCHOR_OBJECTS_KEY] ||= []
+        Serializable.tls_vars[TLS_ANCHOR_OBJECTS_KEY] ||= []
       end
       private :anchor_object_registry_stack
 
@@ -252,7 +258,7 @@ module FIRM
       end
 
       def anchor_references_stack
-        ::Thread.current[TLS_ALIAS_STACK_KEY] ||= []
+        Serializable.tls_vars[TLS_ALIAS_STACK_KEY] ||= []
       end
       private :anchor_references_stack
 

data/lib/firm/serializer/json.rb

@@ -70,7 +70,7 @@ module FIRM
         private_constant :TLS_PARSE_STACK_KEY
 
         def safe_deserialize
-          ::Thread.current[TLS_SAFE_DESERIALIZE_KEY] ||= []
+          Serializable.tls_vars[TLS_SAFE_DESERIALIZE_KEY] ||= []
         end
         private :safe_deserialize
 
@@ -83,7 +83,7 @@ module FIRM
         end
 
         def parse_stack
-          ::Thread.current[TLS_PARSE_STACK_KEY] ||= []
+          Serializable.tls_vars[TLS_PARSE_STACK_KEY] ||= []
         end
         private :parse_stack
 

data/lib/firm/serializer/xml.rb

@@ -20,7 +20,7 @@ module FIRM
           private_constant :TLS_STATE_KEY
 
           def xml_state
-            ::Thread.current[TLS_STATE_KEY] ||= []
+            Serializable.tls_vars[TLS_STATE_KEY] ||= []
           end
           private :xml_state
 
@@ -133,6 +133,22 @@ module FIRM
           end
         end
 
+        # registered as tag 'Class' but that is never actually used
+        define_xml_handler(::Class, 'Class') do
+          # overload to emit 'String' tags
+          def create_type_node(xml)
+            xml.add_child(Nokogiri::XML::Node.new('String', xml.document))
+          end
+          def to_xml(xml, value)
+            create_type_node(xml).add_child(Nokogiri::XML::CDATA.new(xml.document, value.name))
+            xml
+          end
+          def from_xml(xml)
+            # should never be called
+            raise Serializable::Exception, 'Unsupported Class deserialization'
+          end
+        end
+
         define_xml_handler(::NilClass, :nil) do
           def to_xml(xml, _value)
             create_type_node(xml)

data/lib/firm/serializer/yaml.rb

@@ -68,8 +68,26 @@ module FIRM
         end
       end
 
+      # Derived Psych YAMLTree class to emit simple strings for
+      # Class instances
+      class NoClassYAMLTree < ::Psych::Visitors::YAMLTree
+
+        def visit_Class(o)
+          raise TypeError, "can't dump anonymous module: #{o}" unless o.name
+          visit_String(o.name)
+        end
+
+        def visit_Module(o)
+          raise TypeError, "can't dump anonymous class: #{o}" unless o.name
+          visit_String(o.name)
+        end
+
+      end
+
       def self.dump(obj, io=nil, **)
-        ::YAML.dump(obj, io)
+        visitor = YAML::NoClassYAMLTree.create
+        visitor << obj
+        visitor.tree.yaml io
       end
 
       def self.load(source)

data/lib/firm/version.rb

@@ -4,6 +4,6 @@
 module FIRM
 
   # FIRM version
-  VERSION = "0.9.3"
+  VERSION = "0.9.6"
 
 end

data/tests/serializer_tests.rb

@@ -292,6 +292,17 @@ module SerializerTestMixin
 
   end
 
+  def test_class
+
+    obj_serial = [Point, Colour].serialize
+    obj_new = assert_nothing_raised { FIRM.deserialize(obj_serial) }
+    assert_instance_of(::Array, obj_new)
+    assert_true(obj_new.all? { |e| String === e })
+    assert_equal(Point.name, obj_new[0])
+    assert_equal(Colour.name, obj_new[1])
+
+  end
+
   class PointsOwner
     include FIRM::Serializable
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: firm
 version: !ruby/object:Gem::Version
-  version: 0.9.3
+  version: 0.9.6
 platform: ruby
 authors:
 - Martin Corino
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-14 00:00:00.000000000 Z
+date: 2024-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake