mojombo/jekyll — pull request #777 by mastahyeti (2013-01-23 23:37:06+00:00)
Title: Safe YAML

With the recent Rails vulnerabilities it became clear that loading untrusted YAML can be dangerous. YAML provides syntax for (un)marshalling Ruby objects. If an attacker can control YAML that will be parsed by a server, he can force that server to instantiate arbitrary Ruby objects. This can be leveraged to accomplish arbitrary code execution.

The [`safe_yaml`](https://github.com/dtao/safe_yaml) gem works around this and makes it safe to parse untrusted YAML. This PR implements `safe_yaml` across Jekyll.

/cc @mojombo @jnewland