rubygems/rubygems.org — pull request #521 by sj26 (2013-02-02 00:32:44+00:00)
Title: Protect against symbol injection DoS attacks

Expands the YAML whitelisting patch to include whitelisting symbols.

The five symbols whitelisted are surveyed from all metadata of all existing gems using :

* :development and :runtime, used legitimately by `Gem::Dependency`
* :rdoc which is incorrectly serialized in rdoc_options in "fisheye-crucible-0.0.1"
* :json and :mocha, which are incorrectly serialized gem names from `Gem::Dependency`s in some versions of "ezri" (0.03 - 0.07)