hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-19 08:23:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

v4.2 write exact version of yaml.load default loader change

Browse Source
This commit is contained in:
amammad
2023-04-27 06:48:15 +02:00
committed by Harry Maclean
parent 40e24b6b94
commit d727d573d5
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll
View File

@@ -79,7 +79,7 @@ module UnsafeDeserialization {
* for unsafe deserialization. The `YAML` module is an alias of `Psych` in
* recent versions of Ruby.
* the `this = yamlNode().getAMethodCall("load").getArgument(0)` is safe
* in recent versions of YAML library, so it will be removed in future.
* in psych/yaml library after [v4.0.0](https://github.com/ruby/psych/releases/tag/v4.0.0), so it will be removed in future.
*/
class YamlLoadArgument extends Sink {
YamlLoadArgument() {