safe_yaml 0.5.1 → 0.5.2

data/.gitignore

@@ -1 +1,2 @@
+Gemfile.lock
 dist/

data/lib/safe_yaml/transform/to_time.rb

@@ -8,7 +8,10 @@ module SafeYAML
       def transform?(value)
         return false unless MATCHER.match(value)
         datetime = DateTime.parse(value) rescue nil
-        return !!datetime, datetime.to_time
+        if datetime.respond_to?(:to_time)
+          return true, datetime.to_time
+        end
+        false
       end
     end
   end

data/lib/safe_yaml/version.rb

@@ -1,3 +1,3 @@
 module SafeYAML
-  VERSION = "0.5.1"
+  VERSION = "0.5.2"
 end

data/safe_yaml.gemspec

@@ -8,7 +8,7 @@ Gem::Specification.new do |gem|
   gem.email         = "daniel.tao@gmail.com"
   gem.description   = %q{Parse YAML safely, without that pesky arbitrary code execution vulnerability}
   gem.summary       = %q{SameYAML provides an alternative implementation of YAML.load suitable for accepting user input in Ruby applications.}
-  gem.homepage      = "http://github.com/dtao/safe_yaml"
+  gem.homepage      = "http://dtao.github.com/safe_yaml/"
 
   gem.files         = `git ls-files`.split($\)
   gem.test_files    = gem.files.grep(%r{^spec/})

data/spec/safe_yaml_spec.rb

@@ -13,9 +13,7 @@ describe YAML do
         backdoor = YAML.orig_load("--- !ruby/hash:ExploitableBackDoor\nfoo: bar\n")
         backdoor.should be_exploited_through_setter
       end
-    end
 
-    if RUBY_VERSION >= "1.9.2"
       it "allows exploits through objects defined in YAML w/ !ruby/object via the :init_with method" do
         backdoor = YAML.orig_load("--- !ruby/object:ExploitableBackDoor\nfoo: bar\n")
         backdoor.should be_exploited_through_init_with
@@ -110,9 +108,7 @@ describe YAML do
         backdoor = YAML.orig_load_file "spec/exploit.1.9.3.yaml"
         backdoor.should be_exploited_through_setter
       end
-    end
 
-    if RUBY_VERSION >= "1.9.2"
       it "allows exploits through objects defined in YAML w/ !ruby/object via the :init_with method" do
         backdoor = YAML.orig_load_file "spec/exploit.1.9.2.yaml"
         backdoor.should be_exploited_through_init_with

data/spec/shared_specs.rb

@@ -1,5 +1,3 @@
-require File.join(File.dirname(__FILE__), "spec_helper")
-
 module SharedSpecs
   def self.included(base)
     base.instance_eval do
@@ -51,11 +49,6 @@ module SharedSpecs
           result.should == { "date" => Date.parse("2013-01-24") }
         end
 
-        it "translates valid time values" do
-          parse "time: 2013-01-29 05:58:00 -0800"
-          result.should == { "time" => Time.new(2013, 1, 29, 5, 58, 0, "-08:00") }
-        end
-
         it "translates valid true/false values to booleans" do
           parse <<-YAML
             - yes
@@ -108,7 +101,6 @@ module SharedSpecs
             1: integer
             3.14: float
             2013-01-24: date
-            2013-01-29 05:58:00 -0800: time
           YAML
 
           result.should == {
@@ -117,7 +109,6 @@ module SharedSpecs
             1      => "integer",
             3.14   => "float",
             Date.parse("2013-01-24") => "date",
-            Time.new(2013, 1, 29, 5, 58, 0, "-08:00") => "time"
           }
         end
 
@@ -128,10 +119,34 @@ module SharedSpecs
             - 1
             - 3.14
             - 2013-01-24
-            - 2013-01-29 05:58:00 -0800
           YAML
 
-          result.should == ["foo", ":bar", 1, 3.14, Date.parse("2013-01-24"), Time.new(2013, 1, 29, 5, 58, 0, "-08:00")]
+          result.should == ["foo", ":bar", 1, 3.14, Date.parse("2013-01-24")]
+        end
+      end
+
+      context "for Ruby version #{RUBY_VERSION}" do
+        if RUBY_VERSION >= "1.9.2"
+          it "translates valid time values" do
+            parse "time: 2013-01-29 05:58:00 -0800"
+            result.should == { "time" => Time.new(2013, 1, 29, 5, 58, 0, "-08:00") }
+          end
+
+          it "applies the same transformation to keys" do
+            parse "2013-01-29 05:58:00 -0800: time"
+            result.should == { Time.new(2013, 1, 29, 5, 58, 0, "-08:00") => "time" }
+          end
+
+          it "applies the same transformation to elements in sequences" do
+            parse "- 2013-01-29 05:58:00 -0800"
+            result.should == [Time.new(2013, 1, 29, 5, 58, 0, "-08:00")]
+          end
+
+        else
+          it "does not deserialize times" do
+            parse "time: 2013-01-29 05:58:00 -0800"
+            result.should == { "time" => "2013-01-29 05:58:00 -0800" }
+          end
         end
       end
 
@@ -145,37 +160,16 @@ module SharedSpecs
           result.should == { "symbol" => :value }
         end
 
-        it "applies the same transformations to keys as to values" do
-          parse <<-YAML
-            foo: string
-            :bar: symbol
-            1: integer
-            3.14: float
-            2013-01-24: date
-            2013-01-29 05:58:00 -0800: time
-          YAML
+        it "applies the same transformation to keys" do
+          parse ":bar: symbol"
 
-          result.should == {
-            "foo" => "string",
-            :bar  => "symbol",
-            1     => "integer",
-            3.14  => "float",
-            Date.parse("2013-01-24") => "date",
-            Time.new(2013, 1, 29, 5, 58, 0, "-08:00") => "time"
-          }
+          result.should == { :bar  => "symbol" }
         end
 
-        it "applies the same transformations to elements in sequences as to all values" do
-          parse <<-YAML
-            - foo
-            - :bar
-            - 1
-            - 3.14
-            - 2013-01-24
-            - 2013-01-29 05:58:00 -0800
-          YAML
+        it "applies the same transformation to elements in sequences" do
+          parse "- :bar"
 
-          result.should == ["foo", :bar, 1, 3.14, Date.parse("2013-01-24"), Time.new(2013, 1, 29, 5, 58, 0, "-08:00")]
+          result.should == [:bar]
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safe_yaml
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.2
   prerelease: 
 platform: ruby
 authors:
@@ -19,7 +19,6 @@ extra_rdoc_files: []
 files:
 - .gitignore
 - Gemfile
-- Gemfile.lock
 - README.md
 - Rakefile
 - lib/safe_yaml.rb
@@ -44,7 +43,7 @@ files:
 - spec/spec_helper.rb
 - spec/support/exploitable_back_door.rb
 - spec/syck_resolver_spec.rb
-homepage: http://github.com/dtao/safe_yaml
+homepage: http://dtao.github.com/safe_yaml/
 licenses: []
 post_install_message: 
 rdoc_options: []

data/Gemfile.lock

@@ -1,28 +0,0 @@
-PATH
-  remote: .
-  specs:
-    safe_yaml (0.5.1)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    diff-lcs (1.1.3)
-    heredoc_unindent (1.1.2)
-    rake (10.0.3)
-    rspec (2.12.0)
-      rspec-core (~> 2.12.0)
-      rspec-expectations (~> 2.12.0)
-      rspec-mocks (~> 2.12.0)
-    rspec-core (2.12.2)
-    rspec-expectations (2.12.1)
-      diff-lcs (~> 1.1.3)
-    rspec-mocks (2.12.1)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  heredoc_unindent
-  rake
-  rspec
-  safe_yaml!