-
Notifications
You must be signed in to change notification settings - Fork 204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Tried to load unspecified class: HTTP::Cookie (Psych::DisallowedClass) #503
Comments
4.0.0 is a major upgrade, due to the backwards-breaking changes. v3.3.1...v4.0.0 The release includes an "unsafe_load", which could be used in the gem which is raising the error by calling YAML.load ("If .unsafe_load exists, use that, otherwise use .load" would be a way forward, perhaps, in http-cookie?) |
First of all: Thank you guys for your fast and helpful comments. I don't quite understand changing existing method bodies without changing any functionality at all. Wouldn't it be better just to deprecate methods instead of... breaking a lot of gems? ;) A meaningful warning with how to do it better would've had less impact to the whole ecosystem. Don't get me wrong, i'm a friend of security by design. |
Upstream has been made compatible, by having a safe_load code-path: sparklemotion/http-cookie#34 |
Merged and released. Thank you @olleolleolle for your commitment :) |
if your application uses Symbol and Time in serialized data, you can add Symbol and Time to the allowed list as follows:
|
Using fastlane with the latest psych version seems broken. It might have to do with the recently added safe-dump feature.
Downgrading from 4.0.0 to 3.3.0 works again. (Haven't tried versions inbetween).
The text was updated successfully, but these errors were encountered: