Replies: 12 comments
-
|
It's not only about # file: test.rb
require "yaml"
puts "RUBY: #{RUBY_VERSION}"
puts "PSYCH: #{Psych::VERSION}"
puts "LIBYAML: #{Psych::LIBYAML_VERSION}"
source = <<~YAML
foo: &foo
a: 1
b: 2
bar:
<<: *foo
a: 2
YAML
puts YAML.load(source) |
Beta Was this translation helpful? Give feedback.
-
|
Ran into this issue when devise_ldap_authenticatable attempted to parse a LDAP YAML config file that is almost identical to @poloka's original example. It looks like Lines 369 to 376 in ba203f1 Based on a quick glance, it looks like this commit 1764942 8 months ago by @tenderlove is when this behavior was introduced. I'm currently working around this by removing the anchor and aliases and manually duplicating some config. I'm still kinda new to the Ruby software ecosystem, but this seems particularly annoying since most users of Psych don't pull it in as a gem and thus don't explicitly vendor it in their Gemfiles. |
Beta Was this translation helpful? Give feedback.
-
|
@colemannugent if the YAML documents you're loading are trusted (IOW can't be controlled by external users) you can use |
Beta Was this translation helpful? Give feedback.
-
|
@tenderlove In this case I'm not calling Psych directly. I ran into this issue when a gem I use (devise_ldap_authenticatable) attempted to parse a YAML config file that I used anchors and aliases in to avoid repetition. It looks like the way to resolve this is to alert most downstream users of Psych that they'll have examine where they load YAML and determine if it's safe to use |
Beta Was this translation helpful? Give feedback.
-
|
FWIW - A contributor to this situation is an update to |
Beta Was this translation helpful? Give feedback.
-
|
I also ran into this from a github dependabot upgrade of rdoc. (sdoc -> rdoc -> psych) |
Beta Was this translation helpful? Give feedback.
-
@dgm I also ran into this issue. Please guide if there is any solution. |
Beta Was this translation helpful? Give feedback.
-
|
This change breaks facter "custom facts" in production. Please guide if there is any solution. |
Beta Was this translation helpful? Give feedback.
-
|
Hi is there any solution, Even I am facing similar kind of issue. Which is working fine locally but failing at Jenkins when running in a container. |
Beta Was this translation helpful? Give feedback.
-
|
This worked for me on |
Beta Was this translation helpful? Give feedback.
-
|
When running the test with the latest And 5.1.1.1 now indicates So it would seem that the breaking change to how the |
Beta Was this translation helpful? Give feedback.
-
|
I replaced |
Beta Was this translation helpful? Give feedback.
-
Issue
It looks like psych-4.x included a breaking change to how
YAML.safe_loadexecutes causing awrong number of argumentserror when using the old format for performing asafe_load. Take specific note of the differences in the following output on the testing ofTesting 'YAML.safe_load' with options: ([], [], true) using psych-3.3.2 on 2.6.6vsTesting 'YAML.safe_load' with options: ([], [], true) using psych-4.0.3 on 2.6.6.Investigation
Using the following code:
Loading the following file:
Ruby 2.6 with psych-3.3.2 output
Ruby 2.6 with psych-4.0.3 output
Beta Was this translation helpful? Give feedback.
All reactions