From: "ko1 (Koichi Sasada)" <redmine@...>
Date: 2013-02-22T09:22:30+09:00
Subject: [ruby-core:52663] [ruby-trunk - Feature #7677] YAML load mode that does instantiate Ruby


Issue #7677 has been updated by ko1 (Koichi Sasada).

Assignee set to tenderlovemaking (Aaron Patterson)


----------------------------------------
Feature #7677: YAML load mode that does instantiate Ruby 
https://bugs.ruby-lang.org/issues/7677#change-36748

Author: trans (Thomas Sawyer)
Status: Open
Priority: Normal
Assignee: tenderlovemaking (Aaron Patterson)
Category: lib
Target version: next minor


See https://makandracards.com/makandra/892-never-use-yaml-load-with-user-input

I suggest that YAML.load and YAML.load_file have an optional mode that will allow the YAML to load but not instantiate `!ruby/object:` tags, nor any registered tags. To go with this there could be a way to see what the tag is after having been loaded.



-- 
http://bugs.ruby-lang.org/