safe_yaml 0.9.5 → 0.9.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8e55d5619e0fb2c1a1e958e26e649b6d9d6791a3
-  data.tar.gz: fa788dcc6987cd96121f0a86c16259fa93190fd8
+  metadata.gz: a0e318fdb562f8333d33d6d693e838d454a9753a
+  data.tar.gz: 4cae1fb4f5f15d42ae0762c35ae9aa543ddf3dc6
 SHA512:
-  metadata.gz: ed8fb12f633219518a56774fc91efa7cd452dec771f4e16b1483d038dd768d53c749e1e241b81d20f474c619cfc4ba7fb92a041907f83d4888b71967d946ebc0
-  data.tar.gz: 2d3c97331b122aea731c23c8219ec20b94928897b1f4a983bf857fdc67b58b2a4202a90f07fb609f2572a7506f08b86eb6d44fd6ed1a6f1cd575a19a4eb13c8a
+  metadata.gz: 4c61eacf1e4e4f2f6d28d64e88ff7b504150e5516ea01a594d9efef2e50abeb2f9623e2c2a2f58a67ad8297aa8bcc9ddaf70c6e3d0c7de248a630d2b1873bb36
+  data.tar.gz: 8f61f556e31238feeefba576f2503b0369a3591219f2daa9fb81dae80747050f1b80cea51979c7b44cb43f168b993942c31723682d0291d3751393276fda63df

data/CHANGES.md

@@ -1,10 +1,15 @@
+0.9.6
+-----
+
+- fixed handling of files with trailing content (after closing `---`)
+
 0.9.5
 -----
 
 - fixed permissions AGAIN
 
-0.9.4 (yanked)
---------------
+0.9.4
+-----
 
 - corrected handling of symbols
 
@@ -13,8 +18,8 @@
 
 - fixed permissions :(
 
-0.9.2 (yanked)
---------------
+0.9.2
+-----
 
 - fixed error w/ parsing "!" when whitelisting tags
 - fixed parsing of the number 0 (d'oh!)

data/Rakefile

@@ -4,3 +4,10 @@ desc "Run specs"
 RSpec::Core::RakeTask.new(:spec) do |t|
   t.rspec_opts = %w(--color)
 end
+
+namespace :spec do
+  desc "Run only specs tagged 'solo'"
+  RSpec::Core::RakeTask.new(:solo) do |t|
+    t.rspec_opts = %w(--color --tag solo)
+  end
+end

data/lib/safe_yaml.rb

@@ -160,6 +160,8 @@ module YAML
     require "safe_yaml/safe_to_ruby_visitor"
 
     def self.safe_load(yaml, filename=nil, options={})
+      return false if yaml =~ /\A\s*\Z/
+
       # If the user hasn't whitelisted any tags, we can go with this implementation which is
       # significantly faster.
       if (options && options[:whitelisted_tags] || SafeYAML::OPTIONS[:whitelisted_tags]).empty?
@@ -167,7 +169,7 @@ module YAML
         arguments_for_parse = [yaml]
         arguments_for_parse << filename if SafeYAML::MULTI_ARGUMENT_YAML_LOAD
         Psych::Parser.new(safe_handler).parse(*arguments_for_parse)
-        return safe_handler.result || false
+        return safe_handler.result
 
       else
         safe_resolver = SafeYAML::PsychResolver.new(options)

data/lib/safe_yaml/psych_handler.rb

@@ -44,6 +44,16 @@ module SafeYAML
           @current_key = nil
         end
 
+      elsif @current_structure.nil?
+        # It appears that a YAML document may containing trailing text that should not be considered
+        # part of the serialized data. See issue 48:
+        #
+        # https://github.com/dtao/safe_yaml/issues/48
+        #
+        # I need to investigate this a bit further; but for now just explicitly ignoring nil should
+        # fix the issue (since in theory the only scenario where this would happen is after the
+        # serialized structure has "closed").
+
       else
         raise "Don't know how to add to a #{@current_structure.class}!"
       end

data/lib/safe_yaml/transform/to_nil.rb

@@ -6,7 +6,7 @@ module SafeYAML
       set_predefined_values({
         ""      => nil,
         "~"     => nil,
-        "null"  => nil,
+        "null"  => nil
       })
 
       def transform?(value)

data/lib/safe_yaml/version.rb

@@ -1,3 +1,3 @@
 module SafeYAML
-  VERSION = "0.9.5"
+  VERSION = "0.9.6"
 end

data/spec/issue48.yml

@@ -0,0 +1,6 @@
+---
+title: Blah
+key: value
+---
+
+Hey, here are some words!

data/spec/safe_yaml_spec.rb

@@ -115,6 +115,8 @@ describe YAML do
       result = YAML.safe_load <<-YAML.unindent
         foo:
           number: 1
+          boolean: true
+          nil: ~
           string: Hello, there!
           symbol: :blah
           sequence:
@@ -124,9 +126,11 @@ describe YAML do
 
       result.should == {
         "foo" => {
-          "number" => 1,
-          "string" => "Hello, there!",
-          "symbol" => ":blah",
+          "number"   => 1,
+          "boolean"  => true,
+          "nil"      => nil,
+          "string"   => "Hello, there!",
+          "symbol"   => ":blah",
           "sequence" => ["hi", "bye"]
         }
       }
@@ -255,8 +259,18 @@ describe YAML do
     end
     
     it "returns false when parsing an empty document" do
-      result = YAML.safe_load ""
-      result.should == false
+      [
+        YAML.safe_load(""),
+        YAML.safe_load("     "),
+        YAML.safe_load("\n")
+      ].should == [false, false, false]
+    end
+
+    it "returns nil when parsing a single value representing nil" do
+      [
+        YAML.safe_load("~"),
+        YAML.safe_load("null")
+      ].should == [nil, nil]
     end
 
     context "with custom initializers defined" do
@@ -633,6 +647,21 @@ describe YAML do
         YAML.load_file(filename, :safe => true)
       end
     end
+
+    it "handles files starting with --- (see issue #48)" do
+      YAML.load_file("spec/issue48.yml", :safe => true).should == {
+        "title" => "Blah",
+        "key"   => "value"
+      }
+    end
+
+    it "handles content starting with --- (see issue #48)" do
+      yaml = File.read("spec/issue48.yml")
+      YAML.load(yaml, :safe => true).should == {
+        "title" => "Blah",
+        "key"   => "value"
+      }
+    end
   end
 
   describe "whitelist!" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_yaml
 version: !ruby/object:Gem::Version
-  version: 0.9.5
+  version: 0.9.6
 platform: ruby
 authors:
 - Dan Tao
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-07 00:00:00.000000000 Z
+date: 2013-09-16 00:00:00.000000000 Z
 dependencies: []
 description: Parse YAML safely, without that pesky arbitrary object deserialization
   vulnerability
@@ -49,6 +49,7 @@ files:
 - safe_yaml.gemspec
 - spec/exploit.1.9.2.yaml
 - spec/exploit.1.9.3.yaml
+- spec/issue48.yml
 - spec/psych_resolver_spec.rb
 - spec/resolver_specs.rb
 - spec/safe_yaml_spec.rb
@@ -80,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.6
+rubygems_version: 2.0.0.rc.2
 signing_key: 
 specification_version: 4
 summary: SameYAML provides an alternative implementation of YAML.load suitable for
@@ -88,6 +89,7 @@ summary: SameYAML provides an alternative implementation of YAML.load suitable f
 test_files:
 - spec/exploit.1.9.2.yaml
 - spec/exploit.1.9.3.yaml
+- spec/issue48.yml
 - spec/psych_resolver_spec.rb
 - spec/resolver_specs.rb
 - spec/safe_yaml_spec.rb