psych 3.2.0-java → 3.2.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e956d1f39d537bbab914f9d69e070bc18268aa68ecf0ed219f515ae254409654
-  data.tar.gz: c0a085a0afa83a1e78b8f4521a9904e4d800758ecdaff7efe9895faf060ad31c
+  metadata.gz: 41080752c6cb77f7ba4d02b6ecbe2ad1aa2c09d65a8517f382b058b0c6403eea
+  data.tar.gz: 811715a35a69851bc6bafece15c79044a90fa1f41f4244edf9f849f46bae6a42
 SHA512:
-  metadata.gz: 07e866fdc5b8a36fd037ebc6fe1fffa585c4da0a53a997eb0e09fad12717a3bc91d8005fcd9648602b2008e8b648a028b7133291d1306c2c6998a0e15f4be170
-  data.tar.gz: e31fe82bdef97efab8bb201a9fdb06eeafd94413890b2f890087ca15780738e137be16cac2680d2c40bed3a93e32836fa4819494c047e482c9784c8b22229db7
+  metadata.gz: 24f57e51181b8e2e37fe56521ff187259af539d1fd5857ffa07702e398ae1fdf2a7675bc528249afb860e6bab6eee77aa0fcbe89d75b762cd3a1895e6e44abcd
+  data.tar.gz: 63f862bae8f2abf207bc0b27e4b473820188b4e4ae0f1e0d774a76c641dad97c83fa29021a237e40ecfb1ece05560843936630618a005bd530954fde216fdf2b

data/README.md

@@ -12,8 +12,8 @@ serialize and de-serialize most Ruby objects to and from the YAML format.
 ## Examples
 
 ```ruby
-# Load YAML in to a Ruby object
-Psych.load('--- foo') # => 'foo'
+# Safely load YAML in to a Ruby object
+Psych.safe_load('--- foo') # => 'foo'
 
 # Emit YAML from a Ruby object
 Psych.dump("foo")     # => "--- foo\n...\n"

data/lib/psych.rb

@@ -74,12 +74,15 @@ require 'psych/class_loader'
 #
 # ==== Reading from a string
 #
-#   Psych.load("--- a")             # => 'a'
-#   Psych.load("---\n - a\n - b")   # => ['a', 'b']
+#   Psych.safe_load("--- a")             # => 'a'
+#   Psych.safe_load("---\n - a\n - b")   # => ['a', 'b']
+#   # From a trusted string:
+#   Psych.load("--- !ruby/range\nbegin: 0\nend: 42\nexcl: false\n") # => 0..42
 #
 # ==== Reading from a file
 #
-#   Psych.load_file("database.yml")
+#   Psych.safe_load_file("data.yml", permitted_classes: [Date])
+#   Psych.load_file("trusted_database.yml")
 #
 # ==== Exception handling
 #
@@ -276,8 +279,7 @@ module Psych
 
     result = parse(yaml, filename: filename)
     return fallback unless result
-    result = result.to_ruby(symbolize_names: symbolize_names, freeze: freeze) if result
-    result
+    result.to_ruby(symbolize_names: symbolize_names, freeze: freeze)
   end
 
   ###
@@ -549,7 +551,7 @@ module Psych
   #   end
   #   list # => ['foo', 'bar']
   #
-  def self.load_stream yaml, legacy_filename = NOT_GIVEN, filename: nil, fallback: []
+  def self.load_stream yaml, legacy_filename = NOT_GIVEN, filename: nil, fallback: [], **kwargs
     if legacy_filename != NOT_GIVEN
       warn_with_uplevel 'Passing filename with the 2nd argument of Psych.load_stream is deprecated. Use keyword argument like Psych.load_stream(yaml, filename: ...) instead.', uplevel: 1 if $VERBOSE
       filename = legacy_filename
@@ -557,10 +559,10 @@ module Psych
 
     result = if block_given?
                parse_stream(yaml, filename: filename) do |node|
-                 yield node.to_ruby
+                 yield node.to_ruby(**kwargs)
                end
              else
-               parse_stream(yaml, filename: filename).children.map(&:to_ruby)
+               parse_stream(yaml, filename: filename).children.map { |node| node.to_ruby(**kwargs) }
              end
 
     return fallback if result.is_a?(Array) && result.empty?
@@ -571,9 +573,24 @@ module Psych
   # Load the document contained in +filename+.  Returns the yaml contained in
   # +filename+ as a Ruby object, or if the file is empty, it returns
   # the specified +fallback+ return value, which defaults to +false+.
-  def self.load_file filename, fallback: false
+  #
+  # NOTE: This method *should not* be used to parse untrusted documents, such as
+  # YAML documents that are supplied via user input.  Instead, please use the
+  # safe_load_file method.
+  def self.load_file filename, **kwargs
+    File.open(filename, 'r:bom|utf-8') { |f|
+      self.load f, filename: filename, **kwargs
+    }
+  end
+
+  ###
+  # Safely loads the document contained in +filename+.  Returns the yaml contained in
+  # +filename+ as a Ruby object, or if the file is empty, it returns
+  # the specified +fallback+ return value, which defaults to +false+.
+  # See safe_load for options.
+  def self.safe_load_file filename, **kwargs
     File.open(filename, 'r:bom|utf-8') { |f|
-      self.load f, filename: filename, fallback: fallback
+      self.safe_load f, filename: filename, **kwargs
     }
   end
 

data/lib/psych/versions.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 module Psych
   # The version of Psych you are using
-  VERSION = '3.2.0'
+  VERSION = '3.2.1'
 
   if RUBY_ENGINE == 'jruby'
     DEFAULT_SNAKEYAML_VERSION = '1.26'.freeze

data/psych.gemspec

@@ -46,7 +46,6 @@ DESCRIPTION
   s.extra_rdoc_files = ["README.md"]
 
   s.required_ruby_version = Gem::Requirement.new(">= 2.4.0")
-  s.rubygems_version = "2.5.1"
   s.required_rubygems_version = Gem::Requirement.new(">= 0")
 
   if RUBY_ENGINE == 'jruby'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: psych
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.2.1
 platform: java
 authors:
 - Aaron Patterson
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-07-17 00:00:00.000000000 Z
+date: 2020-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement