mperham/sidekiq — pull request #1448 by dtao (2014-01-23 19:29:03+00:00)
Title: pass :safe => false to YAML.load for SafeYAML

Let me acknowledge up front that this is an odd PR. I totally wouldn't blame you for rejecting it.

For a brief explanation of why I'm proposing this, see dtao/safe_yaml#53.

But here's the situation in a nutshell. My gem, SafeYAML, patches `YAML.load` so that application developers can protect against the arbitrary object deserialization exploit found in Rails (and other frameworks) last year. This gem only allows "safe" types to be deserialized: strings, numbers, hashes, etc. The idea is that by requiring SafeYAML, a dev can ensure that none of the libraries they're depending on will expose their app to this vulnerability.

Of course, Sidekiq *needs* to deserialize arbitrary objects for the `delay` extension to work. So here I am suggesting that before calling `YAML.load`, you first see whether the `SafeYAML` module is defined and, if so, pass the requisite `:safe => false` option, letting SafeYAML know not to interfere on this particular call.