yeptris 0.6.28.6 → 0.6.29.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89f169b4286f1630dfd386ebdd39c710292231de7dca13d35c5ae11b63eec0bf
-  data.tar.gz: 209ec594ca38d57ca34155de171688a24bcd28e73226bb5d3e94f68b33773e54
+  metadata.gz: 7651542429f94334197d4065c3742763cbd56cf9910e572fd0bc4350a6ee9af8
+  data.tar.gz: 51cb4f4e38ad1347f29ab35372c83ef4d132b54556df34e4657ca03874a627b3
 SHA512:
-  metadata.gz: 7a317d28c22b3cedc053d29d6c1b03f30c73067d37223cbe2e195a3b7d837fcd33b3a42f14f4e81e313dc3aa422a7c2905d6ace7aac4d4e357a2d6db0c8fb2ed
-  data.tar.gz: 5c15dae41a30d026feeb121e1734d0e1a40e73432fbdfe7d63b0b46382c1f116dc1767817a0ca2bda6f9fcb533bf04a98a5d3a5aac314660a99bed8fa3cfb40e
+  metadata.gz: 9953f85b1cf9f192102ff6ed71c276719c8cdf537c63cbf95e9940c8093c08783e2ec8773aa763f38b5bf2bf71ea5017a252c45b9af726cf6629fb23cd7fa036
+  data.tar.gz: 04b77e4bba61b1bf7382a1957c42df0ae129cef5f3f9f16b1b049b6004a1243b2540f88172931ecf835b00ee92eb2b5d462aa235a5109d122dd93a9f9236e2a9

data/lib/yeptris/node.rb

@@ -394,6 +394,19 @@ class Yeptris::Node
   def scalar_to_ruby
     return symbolize if symbol? && tag_id == :str
 
+    # !ruby/symbol (#258): psych deserializes the scalar to a Symbol
+    # (both spellings; safety is walk_safe's permitted_classes gate)
+    if tag == "!ruby/symbol" || tag == "tag:ruby.yaml.org,2002:symbol"
+      return value.to_s.to_sym
+    end
+
+    # scanner-coercion primitives (psych's ClassLoader-free path)
+    case tag
+    when "!ruby/string", "tag:ruby.yaml.org,2002:string" then return value.to_s
+    when "!ruby/integer", "tag:ruby.yaml.org,2002:integer" then return value.to_i
+    when "!ruby/float", "tag:ruby.yaml.org,2002:float" then return value.to_f
+    end
+
     # stdlib deserialize's tagged-scalar arms: the class tag carries
     # DateTime (dumped tagged — a plain timestamp re-loads as Time)
     if tag == "!ruby/object:DateTime"

data/lib/yeptris/psych.rb

@@ -401,6 +401,42 @@ module Yeptris
       PERMITTED_BY_DEFAULT = [TrueClass, FalseClass, NilClass, Integer, Float,
                               String, Array, Hash].freeze
 
+      CORE_TAGS = %w[str int float bool null timestamp seq map merge value
+                     binary].freeze
+
+      # Both tag spellings to the "ruby/…" short form: the engine may
+      # hand either the "!ruby/symbol" shorthand or the
+      # "tag:ruby.yaml.org,2002:…" URI spelling.
+      def ruby_tag_short(tag)
+        t = tag.sub(/\A!/, "")
+        return t if t.start_with?("ruby/")
+        t.sub(/\Atag:ruby\.yaml\.org,2002:/, "ruby/")
+      end
+
+      # psych's scanner coercion path — always allowed, no class
+      # loader involved (verified against stdlib: !ruby/string with no
+      # permitted_classes loads fine)
+      RUBY_TAG_PRIMITIVES = %w[ruby/string ruby/integer ruby/float].freeze
+
+      # The class a !ruby/… tag names (psych's resolve_class face):
+      # "ruby/symbol" → Symbol; "ruby/object:Foo" and the collection
+      # forms "ruby/hash:Foo" name Foo. Nil = not a class-shaped ruby
+      # tag (or unresolvable) — the caller raises DisallowedClass.
+      RUBY_TAG_SINGLETONS = {
+        "ruby/symbol" => ::Symbol,
+      }.freeze
+
+      def ruby_tag_class(short)
+        return RUBY_TAG_SINGLETONS[short] if RUBY_TAG_SINGLETONS.key?(short)
+
+        rest = short[/\Aruby\/(?:object|hash|array|struct|exception)(?::(.*))?\z/, 1]
+        return nil if rest.nil? || rest.empty?
+        rest.split("::").inject(Object) do |mod, part|
+          return nil unless mod.const_defined?(part, false)
+          mod.const_get(part, false)
+        end
+      end
+
       def check(node, permitted, aliases_enabled)
         case node.kind
         when :alias
@@ -411,9 +447,19 @@ module Yeptris
             # both tag spellings pass: the URI form's last segment and
             # the short "!binary" shorthand (#168's cassettes carry it)
             name = tag.split(":").last.sub(/\A!/, "")
-            unless %w[str int float bool null timestamp seq map merge value
-                      binary].include?(name)
-              raise DisallowedClass, name
+            unless CORE_TAGS.include?(name)
+              # #258: !ruby/… tags follow psych's ClassLoader rules —
+              # the scalar primitives (string/integer/float) coerce
+              # through the scanner and are allowed as-is; !ruby/symbol
+              # passes exactly when Symbol is in permitted_classes;
+              # class-bearing forms (ruby/object:K, ruby/hash:K, …)
+              # pass when K is in permitted_classes
+              short = ruby_tag_short(tag)
+              unless RUBY_TAG_PRIMITIVES.include?(short)
+                klass = ruby_tag_class(short)
+                raise DisallowedClass, name if klass.nil?
+                raise DisallowedClass, name unless permitted.include?(klass)
+              end
             end
           end
           if node.kind == :scalar && node.tag_id == :timestamp &&

data/lib/yeptris/yaml.rb

@@ -269,12 +269,16 @@ module Yeptris
         return false if "-?:".include?(c) && (s.length == 1 || s[1] =~ /[ \t]/)
         return false if s.include?(": ") || s.end_with?(":") || s.include?(" #")
         return false if RESHAPES_SET[s]
-        # compat's float grammar REQUIRES the dot ("1e3" re-reads as a
-        # String and may dump plain); ints/sexagesimals still reshape.
-        # psych's FLOAT has no trailing [.:] group — "1.2.3" is a
-        # String and dumps plain (pinned by spec/yaml_spec.rb)
-        return false if s.match?(/\A[-+]?(0|[1-9][0-9_]*)(:[0-5]?[0-9])+\z/)
+        # ints/sexagesimals reshape: the compat resolver accepts any
+        # digit start (compat11.c), psych's ScalarScanner likewise —
+        # "07:00:00" plain re-reads as Integer, so leading-zero hours
+        # quote too (psych dumps them quoted)
+        return false if s.match?(/\A[-+]?[0-9][0-9_]*(:[0-5]?[0-9])+\z/)
         return false if s.match?(/\A[-+]?(0|[1-9][0-9_]*)\z/)
+        # compat's float grammar REQUIRES the dot ("1e3" re-reads as a
+        # String and may dump plain); psych's FLOAT has no trailing
+        # [.:] group — "1.2.3" is a String and dumps plain (pinned by
+        # spec/yaml_spec.rb)
         return false if s.match?(/\A[-+]?[0-9][0-9_]*\.[0-9_]*([eE][-+]?[0-9]+)?\z/)
         return false if s.match?(/\A[-+]?[0-9][0-9_]*(:[0-5]?[0-9])+\.[0-9_]*\z/)
         return false if s.match?(/\A[-+]?(0x[0-9a-fA-F_]+|0b[01_]+|0o?[0-7_]+)\z/)

data/lib/yeptris.rb

@@ -3,7 +3,7 @@
 module Yeptris
   # The gem's version lives in the parent namespace's file — the last
   # internal require (yeptris/version) retired with it.
-  VERSION = "0.6.28.6".freeze
+  VERSION = "0.6.29.2".freeze
 
   # Informational notices are OPT-IN (yeptris-ruby#217): consumers
   # embed yeptris inside CLIs that assert clean stderr, and a

data/vendor/libyeptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(yeptris
-    VERSION 0.6.28
+    VERSION 0.6.29
     DESCRIPTION "Ultra-fast YAML 1.2 parser, emitter and streamer in C"
     LANGUAGES C CXX
 )

data/vendor/libyeptris/src/yeptris/parse/engine.c

@@ -3060,7 +3060,14 @@ static int e_parse_value(yep_engine* e, yep_ctx ctx, uint16_t floor_col) {
          * continue the value even at the parent column ("k:\n!!seq\n[a]"). */
         if (li.indent > floor_col || e->depth == 0 ||
             (ctx == YEP_CTX_AFTER_Q && li.indent == floor_col && li.first != ':') ||
-            ((li.first == '[' || li.first == '{') && li.indent == floor_col)) {
+            ((li.first == '[' || li.first == '{') && li.indent == floor_col) ||
+            /* libyaml never validates a block-scalar HEADER's column —
+             * only the content must out-indent the parent (e_block_scalar
+             * enforces that), so "|" / ">" at the key's own column is the
+             * pending value (yeptris-ruby#258: the metanorma collection
+             * fixture shape) */
+            (vctx == YEP_CTX_VALUE_LINE && (li.first == '|' || li.first == '>') &&
+             li.indent == floor_col)) {
             e->pos += li.indent;
             return e_node(e, vctx, floor_col);
         }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yeptris
 version: !ruby/object:Gem::Version
-  version: 0.6.28.6
+  version: 0.6.29.2
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi