safe_yaml 0.6.1 → 0.6.2

data/README.md

@@ -1,6 +1,8 @@
 SafeYAML
 ========
 
+[![Build Status](https://travis-ci.org/dtao/safe_yaml.png)](http://travis-ci.org/dtao/safe_yaml)
+
 The **SafeYAML** gem provides an alternative implementation of `YAML.load` suitable for accepting user input in Ruby applications. Unlike Ruby's built-in implementation of `YAML.load`, SafeYAML's version will not expose apps to arbitrary code execution exploits (such as [the one recently discovered in Rails](http://www.reddit.com/r/netsec/comments/167c11/serious_vulnerability_in_ruby_on_rails_allowing/) (or [this one](http://www.h-online.com/open/news/item/Rails-developers-close-another-extremely-critical-flaw-1793511.html))).
 
 Installation
@@ -50,7 +52,7 @@ Observe:
     > "foo; end; puts %(I'm in yr system!); def bar": "baz"
     > EOYAML
     => "--- !ruby/hash:ExploitableClassBuilder\n\"foo; end; puts %(I'm in yr system!); def bar\": \"baz\"\n"
-    
+
     > YAML.load(yaml)
     I'm in yr system!
     => #<ExploitableClassBuilder:0x007fdbbe2e25d8 @class=#<Class:0x007fdbbe2e2510>>
@@ -81,6 +83,8 @@ By default, when you require the safe_yaml gem in your project, `YAML.load` is p
 
 The default behavior can be switched to unsafe loading by calling `YAML.enable_arbitrary_object_deserialization!`. In this case, the `:safe` flag still has the same effect, but the defaults are reversed (so calling `YAML.load` will have the same behavior as if the safe_yaml gem weren't required).
 
+This gem will also warn you whenever you use `YAML.load` without specifying the `:safe` option. If you do not want to see these messages in your logs, you can say `SafeYAML::OPTIONS[:suppress_warnings] = true` in an initializer.
+
 Notes
 -----
 
@@ -97,17 +101,21 @@ The way that SafeYAML works is by restricting the kinds of objects that can be d
 
 Additionally, deserialization of symbols can be enabled by calling `YAML.enable_symbol_parsing!`.
 
+Known Issues
+------------
+
+Also note that some Ruby libraries, particularly those requiring inter-process communication, leverage YAML's object deserialization functionality and therefore may break or otherwise be impacted by SafeYAML. The following list includes known instances of SafeYAML's interaction with other Ruby gems:
+
+- **Guard**: Uses YAML as a serialization format for notifications. The data serialized uses symbol keys, so calling `YAML.enable_symbol_parsing!` is necessary to allow Guard to work.
+
+The above list will grow over time, as more issues are discovered.
+
 Caveat
 ------
 
-Obviously this gem is quite young, and so the API may (read: will) change in future versions. The goal of the gem is to make it as easy as possible to protect existing applications from object deserialization exploits. Any and all feedback is more than welcome.
+This gem is quite young, and so the API may (read: *will*) change in future versions. The goal of the gem is to make it as easy as possible to protect existing applications from object deserialization exploits. Any and all feedback is more than welcome.
 
 Requirements
 ------------
 
 SafeYAML requires Ruby 1.8.7 or newer and works with both [Syck](http://www.ruby-doc.org/stdlib-1.8.7/libdoc/yaml/rdoc/YAML.html) and [Psych](http://github.com/tenderlove/psych).
-
-Code Status
--------------
-
-[![Build Status](https://secure.travis-ci.org/dtao/safe_yaml.png)](http://travis-ci.org/dtao/safe_yaml)

data/lib/safe_yaml.rb

@@ -12,7 +12,8 @@ require "safe_yaml/version"
 module SafeYAML
   OPTIONS = {
     :enable_symbol_parsing => false,
-    :enable_arbitrary_object_deserialization => false
+    :enable_arbitrary_object_deserialization => false,
+    :suppress_warnings => false
   }
 end
 
@@ -131,7 +132,7 @@ module YAML
 
     if safe_mode.nil?
       mode = SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization] ? "unsafe" : "safe"
-      Kernel.warn "Called '#{method}' without the :safe option -- defaulting to #{mode} mode."
+      Kernel.warn "Called '#{method}' without the :safe option -- defaulting to #{mode} mode." unless SafeYAML::OPTIONS[:suppress_warnings]
       safe_mode = !SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization]
     end
 

data/lib/safe_yaml/syck_resolver.rb

@@ -3,15 +3,15 @@ module SafeYAML
     QUOTE_STYLES = [:quote1, :quote2]
 
     def resolve_node(node)
-      case node.kind
-      when :map
+      case node.value
+      when Hash
         return resolve_map(node)
-      when :seq
+      when Array
         return resolve_seq(node)
-      when :scalar
+      when String
         return resolve_scalar(node)
       else
-        raise "Don't know how to resolve a '#{node.kind}' node!"
+        raise "Don't know how to resolve this node: #{node.inspect}"
       end
     end
 

data/lib/safe_yaml/version.rb

@@ -1,3 +1,3 @@
 module SafeYAML
-  VERSION = "0.6.1"
+  VERSION = "0.6.2"
 end

data/spec/safe_yaml_spec.rb

@@ -150,6 +150,17 @@ describe YAML do
       end
     }
 
+    context "with :suppress_warnings set to true" do
+      before :each do SafeYAML::OPTIONS[:suppress_warnings] = true; end
+      after :each do SafeYAML::OPTIONS[:suppress_warnings] = false; end
+
+      it "doesn't issue a warning if :suppress_warnings option is set to true" do
+        SafeYAML::OPTIONS[:suppress_warnings] = true
+        Kernel.should_not_receive(:warn)
+        YAML.load(*arguments)
+      end
+    end
+
     it "issues a warning if the :safe option is omitted" do
       silence_warnings do
         Kernel.should_receive(:warn)

data/spec/shared_specs.rb

@@ -75,6 +75,37 @@ module SharedSpecs
           result.should == { "foo" => "" }
         end
 
+        it "correctly reverse-translates strings encoded via #to_yaml" do
+          parse "5.10".to_yaml
+          result.should == "5.10"
+        end
+
+        it "does not specially parse any double-quoted strings" do
+          parse <<-YAML
+            - "1"
+            - "3.14"
+            - "true"
+            - "false"
+            - "2013-02-03"
+            - "2013-02-03 16:27:00 -0600"
+          YAML
+
+          result.should == ["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"]
+        end
+
+        it "does not specially parse any single-quoted strings" do
+          parse <<-YAML
+            - '1'
+            - '3.14'
+            - 'true'
+            - 'false'
+            - '2013-02-03'
+            - '2013-02-03 16:27:00 -0600'
+          YAML
+
+          result.should == ["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"]
+        end
+
         it "deals just fine with nested maps" do
           parse <<-YAML
             foo:

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safe_yaml
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-02 00:00:00.000000000 Z
+date: 2013-02-05 00:00:00.000000000 Z
 dependencies: []
 description: Parse YAML safely, without that pesky arbitrary object deserialization
   vulnerability