Ruby 3.1.0 with Psych 4 forces YAML.safe_load and throws Psych::DisallowedClass - Githubissues

twitter / twitter-cldr-rb

Ruby implementation of the ICU (International Components for Unicode) that uses the Common Locale Data Repository to format dates, plurals, and more.

Apache License 2.0

673 stars 93 forks source link

Ruby 3.1.0 with Psych 4 forces YAML.safe_load and throws Psych::DisallowedClass #247

Closed doits closed 2 years ago

doits commented 2 years ago

Describe the bug

Just a heads up for Ruby 3.1: It ships with Psych 4 by default and uses YAML.safe_load even with YAML.load, see https://bugs.ruby-lang.org/issues/17866 and https://github.com/ruby/psych/blob/75ab76e7888df143012afb1cb6b89ccca28a4451/lib/psych.rb#L369-L377.

You get this error for example:

/lib/ruby/3.1.0/psych/class_loader.rb:99:in `find': Tried to load unspecified class: Range (Psych::DisallowedClass)

To Reproduce Steps to reproduce the behavior:

Install ruby 3.1.0 with Psych 4
['ALB'].localize('en').sort

Environment Ruby 3.1.0 with Psych 4.0.3

Possible solutions

Refactor all YAML data to be simpler and not to use special classes?
Use YAML.safe_load and manually allow whatever classes are needed (so it works on new and old rubies)
Force the use of Psych 3 while working to support 4, maybe it can be added as an explicit dependency of the gem?

camertron commented 2 years ago

Hey there @doits, thanks for letting me know about this. I've worked up a fix and released it as v6.11.0 😄