secvault 3.2.0 → 3.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/secvault/secrets.rb +30 -2
- data/lib/secvault/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 710d3e06fdda8db93c2e7ca401e8eaa9aa973b5c350dba8773a15a41458c71df
|
|
4
|
+
data.tar.gz: 123cf43f089b2880f4c80035253510c97aaff711193c41e40b768605702a06db
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 257a70771cad2fe8581071a9aad9a3abc18fabf176d1ed902fd9962657a8a15a1e8a8d966b9a00912e4aa58eb129f4e1d3ba754d6e319aab4c2f0d05ffcd5a31
|
|
7
|
+
data.tar.gz: 5783d0e4fa433d1beb8984e7d8a7d5946502249b4449e5e6ba97f2eedadf1063ec1982e11327757ee593aa9198a3203461ee1a59f3cb01356b1a800ba0aadbd7
|
data/lib/secvault/secrets.rb
CHANGED
|
@@ -6,9 +6,37 @@ require "active_support/ordered_options"
|
|
|
6
6
|
require "pathname"
|
|
7
7
|
require "erb"
|
|
8
8
|
require "yaml"
|
|
9
|
+
require "bigdecimal"
|
|
10
|
+
require "date"
|
|
9
11
|
|
|
10
12
|
module Secvault
|
|
11
13
|
class Secrets
|
|
14
|
+
# Define permitted classes for YAML.safe_load - commonly used in Rails secrets
|
|
15
|
+
PERMITTED_YAML_CLASSES = [
|
|
16
|
+
Symbol,
|
|
17
|
+
Date,
|
|
18
|
+
Time,
|
|
19
|
+
DateTime,
|
|
20
|
+
BigDecimal,
|
|
21
|
+
Range,
|
|
22
|
+
Regexp
|
|
23
|
+
].tap do |classes|
|
|
24
|
+
# Add ActiveSupport classes if available
|
|
25
|
+
begin
|
|
26
|
+
require "active_support/time_with_zone"
|
|
27
|
+
classes << ActiveSupport::TimeWithZone
|
|
28
|
+
rescue LoadError
|
|
29
|
+
# ActiveSupport not available, skip
|
|
30
|
+
end
|
|
31
|
+
|
|
32
|
+
begin
|
|
33
|
+
require "active_support/duration"
|
|
34
|
+
classes << ActiveSupport::Duration
|
|
35
|
+
rescue LoadError
|
|
36
|
+
# ActiveSupport not available, skip
|
|
37
|
+
end
|
|
38
|
+
end.freeze
|
|
39
|
+
|
|
12
40
|
class << self
|
|
13
41
|
def setup(app)
|
|
14
42
|
# Auto-setup for all Rails versions with consistent behavior
|
|
@@ -68,7 +96,7 @@ module Secvault
|
|
|
68
96
|
|
|
69
97
|
# Process ERB and parse YAML - using same method as Rails
|
|
70
98
|
erb_result = ERB.new(source).result
|
|
71
|
-
secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(erb_result) : YAML.
|
|
99
|
+
secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(erb_result) : YAML.safe_load(erb_result, aliases: true, permitted_classes: PERMITTED_YAML_CLASSES)
|
|
72
100
|
|
|
73
101
|
secrets ||= {}
|
|
74
102
|
|
|
@@ -81,7 +109,7 @@ module Secvault
|
|
|
81
109
|
if secrets_path.exist?
|
|
82
110
|
# Handle plain YAML secrets.yml only - using same method as Rails
|
|
83
111
|
erb_result = ERB.new(secrets_path.read).result
|
|
84
|
-
all_secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(erb_result) : YAML.
|
|
112
|
+
all_secrets = YAML.respond_to?(:unsafe_load) ? YAML.unsafe_load(erb_result) : YAML.safe_load(erb_result, aliases: true, permitted_classes: PERMITTED_YAML_CLASSES)
|
|
85
113
|
|
|
86
114
|
env_secrets = all_secrets[env.to_s]
|
|
87
115
|
return env_secrets.deep_symbolize_keys if env_secrets
|
data/lib/secvault/version.rb
CHANGED