Psych.safe_load internal convert matching scaler Strings that looks like timestamps to class Time which isn't allowed as deserialization class
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 597
- Forks
- 223
- Avg merge
- 11h 23m
- Merged PRs (30d)
- 3
Description
At writing a simple example i realize that "dump/serialization" suffers from same problem.
Ruby/Psych: Latest ruby 3.3.x
y.yaml:
---
time: 2025-04-02 13:43:04.841676 +02:00
Ruby Code that tries to load file above
require 'yaml'
a = YAML.load(File.read('/y.yaml'))
Results in a Tried to load unspecified class: Time (Psych::DisallowedClass).
I expect following that psych handles this either by bypassing or allowing it (DisallowdClass). Or handles timestamp like strings AS string.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report with the shown y.yaml and YAML.load example, then compare it with Psych.safe_load behavior. The payload names no files or tests; done should be a documented, tested decision for how timestamp-like strings are handled without the reported Psych::DisallowedClass error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100