class Burner::Library::Deserialize::Yaml
Take a YAML string and deserialize into object(s). It uses YAML#safe_load by default, which ensures only a limited number of Ruby object constants can be hydrated by the YAML. If you wish to ease this restriction, for example if you have custom serialization for custom classes, then you can pass in safe: false.
Expected Payload input: string of YAML data. Payloadoutput: anything as specified by the YAML de-serializer.
Attributes
safe[R]
Public Class Methods
new(name: '', register: DEFAULT_REGISTER, safe: true)
click to toggle source
Calls superclass method
Burner::JobWithRegister::new
# File lib/burner/library/deserialize/yaml.rb, line 23 def initialize(name: '', register: DEFAULT_REGISTER, safe: true) super(name: name, register: register) @safe = safe freeze end
Public Instance Methods
perform(output, payload)
click to toggle source
The YAML cop was disabled because the consumer may want to actually load unsafe YAML, which can load pretty much any type of class instead of putting the loader in a sandbox. By default, though, we will try and drive them towards using it in the safer alternative. rubocop:disable Security/YAMLLoad
# File lib/burner/library/deserialize/yaml.rb, line 36 def perform(output, payload) output.detail('Warning: loading YAML not using safe_load.') unless safe value = payload[register] payload[register] = safe ? YAML.safe_load(value) : YAML.load(value) end