Skip to content

Commit

Permalink
Tweak specs for Security/YAMLLoad
Browse files Browse the repository at this point in the history
Follow #10424.

Ruby 3.1+ (Psych 4) uses `Psych.load` as `Psych.safe_load` by default.
So, only Ruby 3.0 and earlier will be warned about using `YAML.load`.
  • Loading branch information
koic committed Feb 29, 2024
1 parent b4cc305 commit 8acce28
Showing 1 changed file with 19 additions and 17 deletions.
36 changes: 19 additions & 17 deletions spec/rubocop/cop/security/yaml_load_spec.rb
Expand Up @@ -13,26 +13,28 @@
expect_no_offenses('Module::YAML.load("foo")')
end

it 'registers an offense and corrects load with a literal string' do
expect_offense(<<~RUBY)
YAML.load("--- !ruby/object:Foo {}")
^^^^ Prefer using `YAML.safe_load` over `YAML.load`.
RUBY
context 'Ruby <= 3.0', :ruby30 do
it 'registers an offense and corrects load with a literal string' do
expect_offense(<<~RUBY)
YAML.load("--- !ruby/object:Foo {}")
^^^^ Prefer using `YAML.safe_load` over `YAML.load`.
RUBY

expect_correction(<<~RUBY)
YAML.safe_load("--- !ruby/object:Foo {}")
RUBY
end
expect_correction(<<~RUBY)
YAML.safe_load("--- !ruby/object:Foo {}")
RUBY
end

it 'registers an offense and corrects a fully qualified ::YAML.load' do
expect_offense(<<~RUBY)
::YAML.load("--- foo")
^^^^ Prefer using `YAML.safe_load` over `YAML.load`.
RUBY
it 'registers an offense and corrects a fully qualified ::YAML.load' do
expect_offense(<<~RUBY)
::YAML.load("--- foo")
^^^^ Prefer using `YAML.safe_load` over `YAML.load`.
RUBY

expect_correction(<<~RUBY)
::YAML.safe_load("--- foo")
RUBY
expect_correction(<<~RUBY)
::YAML.safe_load("--- foo")
RUBY
end
end

# Ruby 3.1+ (Psych 4) uses `Psych.load` as `Psych.safe_load` by default.
Expand Down

0 comments on commit 8acce28

Please sign in to comment.