Document and test YAML.safe_load

2026-04-26 01:05:15 +02:00 · 2021-09-08 18:22:31 +01:00
parent 760dbd739d
commit 2ddca2c0db
3 changed files with 14 additions and 2 deletions
--- a/ql/test/query-tests/security/cwe-502/UnsafeDeserialization.rb
+++ b/ql/test/query-tests/security/cwe-502/UnsafeDeserialization.rb
@@ -38,4 +38,10 @@ class UsersController < ActionController::Base
    yaml_data = params[:key]
    object = YAML.load yaml_data
  end
+
+  # GOOD
+  def route6
+    yaml_data = params[:key]
+    object = YAML.safe_load yaml_data
+  end
 end