ruby/backport-0002-CVE-2024-35221.patch
shixuantong 9f8fa5c321 fix CVE-2024-35221
(cherry picked from commit 34f44629e9ba1167cfcf03edeae24b819162072d)
2024-06-18 14:25:05 +08:00

40 lines
1.2 KiB
Diff

From 5dcc7a03267216feaa587017ef5d6d075b62f75b Mon Sep 17 00:00:00 2001
From: Samuel Giddins <segiddins@segiddins.me>
Date: Fri, 9 Feb 2024 10:15:40 -0800
Subject: [PATCH] [rubygems/rubygems] Use a writer method on the module instead
of a constant
https://github.com/rubygems/rubygems/commit/240d84eea3
Reference:https://github.com/ruby/ruby/commit/5dcc7a03267216feaa587017ef5d6d075b62f75b
Conflict:use YAML module not Psych module.
---
lib/rubygems/safe_yaml.rb | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/rubygems/safe_yaml.rb b/lib/rubygems/safe_yaml.rb
index c536a45..9cf7c13 100644
--- a/lib/rubygems/safe_yaml.rb
+++ b/lib/rubygems/safe_yaml.rb
@@ -24,11 +24,13 @@ module Gem
runtime
].freeze
- ALIASES = true # :nodoc:
- private_constant :ALIASES
+ @aliases_enabled = true
+ def self.aliases_enabled=(value)
+ @aliases_enabled = !!value
+ end
def self.safe_load(input)
- ::YAML.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: ALIASES)
+ ::YAML.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: @aliases_enabled)
end
def self.load(input)
--
2.33.0