class RuboCop::Cop::Security::YAMLLoad
Checks for the use of YAML class methods which have potential security issues leading to remote code execution when loading from an untrusted source.
NOTE: Ruby 3.1+ (Psych 4) uses ‘Psych.load` as `Psych.safe_load` by default.
@safety
The behavior of the code might change depending on what was in the YAML payload, since `YAML.safe_load` is more restrictive.
@example
# bad YAML.load("--- !ruby/object:Foo {}") # Psych 3 is unsafe by default # good YAML.safe_load("--- !ruby/object:Foo {}", [Foo]) # Ruby 2.5 (Psych 3) YAML.safe_load("--- !ruby/object:Foo {}", permitted_classes: [Foo]) # Ruby 3.0- (Psych 3) YAML.load("--- !ruby/object:Foo {}", permitted_classes: [Foo]) # Ruby 3.1+ (Psych 4) YAML.dump(foo)
Constants
- MSG
- RESTRICT_ON_SEND
Public Instance Methods
on_send(node)
click to toggle source
# File lib/rubocop/cop/security/yaml_load.rb, line 37 def on_send(node) return if target_ruby_version >= 3.1 yaml_load(node) do add_offense(node.loc.selector) do |corrector| corrector.replace(node.loc.selector, 'safe_load') end end end