Skip to content

AO3-6853 Update environment configs to use safe deserialization #5525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
richard-hajek wants to merge 5 commits into
base: master
Choose a base branch
from
Open

AO3-6853 Update environment configs to use safe deserialization #5525

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d21c7b2
fix: safe yaml load
richard-hajek Dec 28, 2025
7372fc7
fix: removed extra import
richard-hajek Dec 28, 2025
d44b4a6
fix: rubocop lint
richard-hajek Jan 2, 2026
0ee1664
Revert "fix: rubocop lint"
richard-hajek Jan 2, 2026
e854d88
Reapply "fix: rubocop lint"
richard-hajek Jan 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions config/application.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@

module Otwarchive
class Application < Rails::Application
app_config = YAML.load_file(Rails.root.join("config/config.yml"))
app_config.merge!(YAML.load_file(Rails.root.join("config/local.yml"))) if File.exist?(Rails.root.join("config/local.yml"))
app_config = YAML.safe_load_file(Rails.root.join("config/config.yml"))
app_config.merge!(YAML.safe_load_file(Rails.root.join("config/local.yml"))) if File.exist?(Rails.root.join("config/local.yml"))
::ArchiveConfig = OpenStruct.new(app_config)

# Please, add to the `ignore` list any other `lib` subdirectories that do
Expand Down
2 changes: 1 addition & 1 deletion config/deploy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@
set :repository, "https://github.com/otwcode/otwarchive.git"
set :deploy_via, :remote_cache

set :servers, -> { YAML.load_file(File.join(__dir__, "servers.yml")).deep_symbolize_keys[fetch(:stage)] }
set :servers, -> { YAML.safe_load_file(File.join(__dir__, "servers.yml")).deep_symbolize_keys[fetch(:stage)] }

# overwrite default capistrano deploy tasks
namespace :deploy do
Expand Down
2 changes: 1 addition & 1 deletion config/initializers/gem-plugin_config/redis.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
# https://gist.github.com/441072
start_redis!(rails_root, :cucumber) if rails_env == :test && !(ENV["CI"] || ENV["DOCKER"])

redis_configs = YAML.load_file("#{rails_root}/config/redis.yml", symbolize_names: true)
redis_configs = YAML.safe_load_file("#{rails_root}/config/redis.yml", symbolize_names: true)
redis_configs.each_pair do |name, redis_config|
redis_options = {}
if redis_config[rails_env].is_a?(Hash)
Expand Down
2 changes: 1 addition & 1 deletion config/initializers/gem-plugin_config/resque.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
rails_root = ENV["RAILS_ROOT"] || "#{File.dirname(__FILE__)}/../../.."
rails_env = (ENV["RAILS_ENV"] || "development").to_sym

redis_configs = YAML.load_file("#{rails_root}/config/redis.yml", symbolize_names: true)
redis_configs = YAML.safe_load_file("#{rails_root}/config/redis.yml", symbolize_names: true)
Resque.redis = redis_configs[:redis_resque][rails_env]

# in-process performing of jobs (for testing) doesn't require a redis server
Expand Down
2 changes: 1 addition & 1 deletion lib/tasks/resque.rake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ namespace :resque do

# The schedule doesn't need to be stored in a YAML, it just needs to
# be a hash. YAML is usually the easiest.
Resque.schedule = YAML.load_file("#{Rails.root}/config/resque_schedule.yml")
Resque.schedule = YAML.safe_load_file(Rails.root.join("config/resque_schedule.yml"))

# If your schedule already has +queue+ set for each job, you don't
# need to require your jobs. This can be an advantage since it's
Expand Down
Loading