Issue #17866 has been updated by k0kubun (Takashi Kokubun).


I noticed `Psych.unsafe_load` uses `aliases: false` by default. This means that default `config/database.yml` of Rails will stop working if you use Psych 4.0.0.

https://github.com/rails/rails/blob/v6.1.3.2/railties/lib/rails/generators/rails/app/templates/config/databases/sqlite3.yml.tt#L7
https://github.com/rails/rails/blob/v6.1.3.2/activesupport/lib/active_support/configuration_file.rb#L22
https://github.com/rails/rails/blob/v6.1.3.2/railties/lib/rails/application/configuration.rb#L275

How about using `aliases: true` by default in `Psych.load`? I guess the main purpose of the breaking change was to disallow object deserialization, and disabling aliases wasn't really important.

----------------------------------------
Bug #17866: Incompatible changes with Psych 4.0.0
https://bugs.ruby-lang.org/issues/17866#change-91998

* Author: hsbt (Hiroshi SHIBATA)
* Status: Assigned
* Priority: Normal
* Assignee: tenderlovemaking (Aaron Patterson)
* Backport: 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
----------------------------------------
Psych-4.0.0 changes `Psych.safe_load` by the default.

https://github.com/ruby/psych/pull/487

It breaks the several code like:

* https://github.com/ruby/ruby/commit/da5b28396397ace84d914cb188055cbeb46b8725
* https://github.com/ruby/ruby/commit/8e91b969df08b7a2eb27a5d6d38733eea42dc7ad
* https://github.com/ruby/ruby/commit/d8fd92f62024d85271a3f1125bc6928409f912e1
* https://github.com/ruby/ruby/commit/dfecc650c3f9bbd8b4fb0eefc1e3da65f151d3a8
* etc...

I and @mame investigate them. We found 2 issues.

1. `Symbol` is still ignored `Pysch.load`. It break many of code like configuration store. https://github.com/ruby/psych/blob/master/lib/psych.rb#L368 passes `Symbol` used by `permitted_classes`. But It's not working now. see https://github.com/ruby/psych/issues/490
2. `Pysch.load` restrict `Gem::Specification` or `RDoc::Options` by the default. Should we add them with`permitted_classes` to `Psych.load` or `Psych.load_file`? I'm not sure the right way about them.

@tenderlovemaking Do you have any ideas about the above concerns?




-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request / ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>