Switch settings to safe yaml load (#19928)

2023-08-16 11:43:00 -04:00 · 2023-08-16 11:43:00 -04:00 · 66e7f8f5e3
commit 66e7f8f5e3
parent 3f07d43e72
1 changed files with 11 additions and 1 deletions
--- a/app/models/settings/base.rb
+++ b/app/models/settings/base.rb
@ -153,7 +153,17 @@ module Settings

    # get the setting's value, YAML decoded
    def value
-      YAML.unsafe_load(self[:value]) if self[:value].present?
+      return if self[:value].blank?
+
+      YAML.safe_load(self[:value],
+                     permitted_classes: [
+                       ActiveSupport::HashWithIndifferentAccess,
+                       ActiveSupport::TimeZone,
+                       ActiveSupport::TimeWithZone,
+                       BigDecimal,
+                       Symbol,
+                       Time,
+                     ])
    end

    # set the settings's value, YAML encoded