Security changes in Psych gem

Upgrading the ruby instance for correctedtime.com uncovered this surprise; Psych (YAML library) won’t parse YAML specifying arbitrary ruby classes. As I use a YAML encoded column to store result data, the upgrade needed to specify allowed classes.

Specified in production.rb and it’s counterparts:

config.active_record.yaml_column_permitted_classes =  ['Symbol', 'Event::Row', 'Event::BoatRow']
James Cowlishaw @Cowlibob
Mastodon