safe_yaml 0.9.6 → 0.9.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a0e318fdb562f8333d33d6d693e838d454a9753a
-  data.tar.gz: 4cae1fb4f5f15d42ae0762c35ae9aa543ddf3dc6
+  metadata.gz: d56ceb5aefcdb8415178936b17589f26139ec062
+  data.tar.gz: cd7b6f5d702b6680eb17116a832f0e651737d599
 SHA512:
-  metadata.gz: 4c61eacf1e4e4f2f6d28d64e88ff7b504150e5516ea01a594d9efef2e50abeb2f9623e2c2a2f58a67ad8297aa8bcc9ddaf70c6e3d0c7de248a630d2b1873bb36
-  data.tar.gz: 8f61f556e31238feeefba576f2503b0369a3591219f2daa9fb81dae80747050f1b80cea51979c7b44cb43f168b993942c31723682d0291d3751393276fda63df
+  metadata.gz: 4c4686cc5c8a087bbebdc706862223a3d9df7e28b559d32ff6c9ea1bf8db02d273b5b8cc425f903b8ed20e31915381149e3f330b8815ef20bc6de9f428963dff
+  data.tar.gz: ded13cfdc5044e90220bc24d058a79c89c7a319cbe3b120a09ca1e73d78d6dc2d2a32b90f358c06dd2d3f9585e3836246a6df855dcd5cdcc6a4cd38bc9df6b29

data/CHANGES.md

@@ -1,3 +1,9 @@
+0.9.7
+-----
+
+- made handling of document frontmatter more robust
+- added more descriptive message to the warning for omitting the :safe option
+
 0.9.6
 -----
 

data/lib/safe_yaml.rb

@@ -165,11 +165,12 @@ module YAML
       # If the user hasn't whitelisted any tags, we can go with this implementation which is
       # significantly faster.
       if (options && options[:whitelisted_tags] || SafeYAML::OPTIONS[:whitelisted_tags]).empty?
-        safe_handler = SafeYAML::PsychHandler.new(options)
+        safe_handler = SafeYAML::PsychHandler.new(options) do |result|
+          return result
+        end
         arguments_for_parse = [yaml]
         arguments_for_parse << filename if SafeYAML::MULTI_ARGUMENT_YAML_LOAD
         Psych::Parser.new(safe_handler).parse(*arguments_for_parse)
-        return safe_handler.result
 
       else
         safe_resolver = SafeYAML::PsychResolver.new(options)
@@ -236,10 +237,17 @@ module YAML
     def safe_mode_from_options(method, options={})
       if options[:safe].nil?
         safe_mode = SafeYAML::OPTIONS[:default_mode] || :safe
+
         if SafeYAML::OPTIONS[:default_mode].nil? && !SafeYAML::OPTIONS[:suppress_warnings]
-          Kernel.warn "Called '#{method}' without the :safe option -- defaulting to #{safe_mode} mode."
+
+          Kernel.warn <<-EOWARNING.gsub(/^\s+/, '')
+            Called '#{method}' without the :safe option -- defaulting to #{safe_mode} mode.
+            You can avoid this warning in the future by setting the SafeYAML::OPTIONS[:default_mode] option (to :safe or :unsafe).
+          EOWARNING
+
           SafeYAML::OPTIONS[:suppress_warnings] = true
         end
+
         return safe_mode
       end
 

data/lib/safe_yaml/psych_handler.rb

@@ -3,8 +3,9 @@ require "base64"
 
 module SafeYAML
   class PsychHandler < Psych::Handler
-    def initialize(options)
+    def initialize(options, &block)
       @options      = SafeYAML::OPTIONS.merge(options || {})
+      @block        = block
       @initializers = @options[:custom_initializers] || {}
       @anchors      = {}
       @stack        = []
@@ -44,16 +45,6 @@ module SafeYAML
           @current_key = nil
         end
 
-      elsif @current_structure.nil?
-        # It appears that a YAML document may containing trailing text that should not be considered
-        # part of the serialized data. See issue 48:
-        #
-        # https://github.com/dtao/safe_yaml/issues/48
-        #
-        # I need to investigate this a bit further; but for now just explicitly ignoring nil should
-        # fix the issue (since in theory the only scenario where this would happen is after the
-        # serialized structure has "closed").
-
       else
         raise "Don't know how to add to a #{@current_structure.class}!"
       end
@@ -65,7 +56,7 @@ module SafeYAML
     end
 
     def streaming?
-      false
+      true
     end
 
     # event handlers
@@ -77,6 +68,10 @@ module SafeYAML
       add_to_current_structure(value, anchor, quoted, tag)
     end
 
+    def end_document(implicit)
+      @block.call(@result)
+    end
+
     def start_mapping(anchor, tag, implicit, style)
       map = @initializers.include?(tag) ? @initializers[tag].call : {}
       self.add_to_current_structure(map, anchor)

data/lib/safe_yaml/version.rb

@@ -1,3 +1,3 @@
 module SafeYAML
-  VERSION = "0.9.6"
+  VERSION = "0.9.7"
 end

data/spec/issue48.txt

@@ -0,0 +1,20 @@
+---
+title: Blah
+key: value
+---
+
+I'm going to inject a bunch of YAML-looking stuff below and it should all just get ignored.
+
+foo: bar
+
+- foo
+- bar
+
+:foo
+42
+~
+
+---
+text: |
+  Look, I'm another YAML document!
+---

data/spec/safe_yaml_spec.rb

@@ -649,14 +649,14 @@ describe YAML do
     end
 
     it "handles files starting with --- (see issue #48)" do
-      YAML.load_file("spec/issue48.yml", :safe => true).should == {
+      YAML.load_file("spec/issue48.txt", :safe => true).should == {
         "title" => "Blah",
         "key"   => "value"
       }
     end
 
     it "handles content starting with --- (see issue #48)" do
-      yaml = File.read("spec/issue48.yml")
+      yaml = File.read("spec/issue48.txt")
       YAML.load(yaml, :safe => true).should == {
         "title" => "Blah",
         "key"   => "value"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: safe_yaml
 version: !ruby/object:Gem::Version
-  version: 0.9.6
+  version: 0.9.7
 platform: ruby
 authors:
 - Dan Tao
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-16 00:00:00.000000000 Z
+date: 2013-09-17 00:00:00.000000000 Z
 dependencies: []
 description: Parse YAML safely, without that pesky arbitrary object deserialization
   vulnerability
@@ -49,7 +49,7 @@ files:
 - safe_yaml.gemspec
 - spec/exploit.1.9.2.yaml
 - spec/exploit.1.9.3.yaml
-- spec/issue48.yml
+- spec/issue48.txt
 - spec/psych_resolver_spec.rb
 - spec/resolver_specs.rb
 - spec/safe_yaml_spec.rb
@@ -81,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0.rc.2
+rubygems_version: 2.0.6
 signing_key: 
 specification_version: 4
 summary: SameYAML provides an alternative implementation of YAML.load suitable for
@@ -89,7 +89,7 @@ summary: SameYAML provides an alternative implementation of YAML.load suitable f
 test_files:
 - spec/exploit.1.9.2.yaml
 - spec/exploit.1.9.3.yaml
-- spec/issue48.yml
+- spec/issue48.txt
 - spec/psych_resolver_spec.rb
 - spec/resolver_specs.rb
 - spec/safe_yaml_spec.rb

data/spec/issue48.yml

@@ -1,6 +0,0 @@
----
-title: Blah
-key: value
----
-
-Hey, here are some words!