From 66e7f8f5e39a6f8ebdfb49e5dd15e41e86555c8d Mon Sep 17 00:00:00 2001
From: Joshua Wehner <joshua@forem.com>
Date: Wed, 16 Aug 2023 11:43:00 -0400
Subject: [PATCH] Switch settings to safe yaml load (#19928)

---
 app/models/settings/base.rb | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/models/settings/base.rb b/app/models/settings/base.rb
index c2699f369..c4c004434 100644
--- a/app/models/settings/base.rb
+++ b/app/models/settings/base.rb
@@ -153,7 +153,17 @@ module Settings
 
     # get the setting's value, YAML decoded
     def value
-      YAML.unsafe_load(self[:value]) if self[:value].present?
+      return if self[:value].blank?
+
+      YAML.safe_load(self[:value],
+                     permitted_classes: [
+                       ActiveSupport::HashWithIndifferentAccess,
+                       ActiveSupport::TimeZone,
+                       ActiveSupport::TimeWithZone,
+                       BigDecimal,
+                       Symbol,
+                       Time,
+                     ])
     end
 
     # set the settings's value, YAML encoded