Use YAML.safe_load

files/enc.rb

@@ -120,7 +120,7 @@ def parse_file(filename, mac_address_workaround = false)
   when '.yaml'
     data = File.read(filename)
     quote_macs!(data) if mac_address_workaround && YAML.load('22:22:22:22:22:22').is_a?(Integer)
-    YAML.load(data.gsub(/\!ruby\/object.*$/,''))
+    YAML.safe_load(data.gsub(/\!ruby\/object.*$/,''), permitted_classes: [Symbol, Time])
   when '.json'
     JSON.parse(File.read(filename))
   else

spec/unit/report_spec.rb

@@ -16,8 +16,23 @@
   eval File.read(File.join(__dir__, '..', '..', 'files', 'report.rb'))
   let(:processor) { Puppet::Reports.report(:foreman) }
 
+  subject do
+    path = File.join(static_fixture_path, report)
+    content = if YAML.respond_to?(:safe_load_file)
+                YAML.safe_load_file(
+                  path,
+                  aliases: true,
+                  permitted_classes: [Symbol, Time, Puppet::Util::Log, Puppet::Transaction::Report, Puppet::Resource::Status, Puppet::Transaction::Event, Puppet::Util::Metric]
+                )
+              else
+                YAML.load_file(path)
+              end
+    content.extend(processor)
+  end
+
   describe "making a connection" do
-    subject { YAML.load_file("#{static_fixture_path}/report-format-3.yaml").extend(processor) }
+    let(:report) { 'report-format-3.yaml' }
+
     it "should connect to the URL in the processor" do
       stub = stub_request(:post, "http://localhost:3000/api/config_reports")
       subject.process
@@ -26,7 +41,7 @@
   end
 
   describe "retry on failed connection" do
-    subject { YAML.load_file("#{static_fixture_path}/report-format-3.yaml").extend(processor) }
+    let(:report) { 'report-format-3.yaml' }
 
     it "should retry the URL in the processor" do
       stub = stub_request(:post, "http://localhost:3000/api/config_reports").to_timeout().then().to_return({status: [200, 'OK']})
@@ -42,70 +57,80 @@
   end
 
   describe "Puppet Report Format 2" do
-    subject { YAML.load_file("#{static_fixture_path}/report-format-2.yaml").extend(processor) }
+    let(:report) { 'report-format-2.yaml' }
+
     it {
       expect(subject.generate_report).to eql(JSON.parse(File.read("#{static_fixture_path}/report-format-2.json")))
     }
   end
 
   describe "Puppet Report Format 3" do
-    subject { YAML.load_file("#{static_fixture_path}/report-format-3.yaml").extend(processor) }
+    let(:report) { 'report-format-3.yaml' }
+
     it {
       expect(subject.generate_report).to eql(JSON.parse(File.read("#{static_fixture_path}/report-format-3.json")))
     }
   end
 
   describe "Puppet Report Format 6" do
-    subject { YAML.load_file("#{static_fixture_path}/report-format-6.yaml").extend(processor) }
+    let(:report) { 'report-format-6.yaml' }
+
     it {
       expect(subject.generate_report).to eql(JSON.parse(File.read("#{static_fixture_path}/report-format-6.json")))
     }
   end
 
   describe "report should support failure metrics" do
-    subject { YAML.load_file("#{static_fixture_path}/report-2.6.5-errors.yaml").extend(processor) }
+    let(:report) { 'report-2.6.5-errors.yaml' }
+
     it {
       expect(subject.generate_report['status']['failed']).to eql 3
     }
   end
 
   describe "report should not support noops" do
-    subject { YAML.load_file("#{static_fixture_path}/report-2.6.12-noops.yaml").extend(processor) }
+    let(:report) { 'report-2.6.12-noops.yaml' }
+
     it {
       expect(subject.generate_report['status']['pending']).to eql 10
     }
   end
 
   describe "empty reports have the correct format" do
-    subject { YAML.load_file("#{static_fixture_path}/report-empty.yaml").extend(processor) }
+    let(:report) { 'report-empty.yaml' }
+
     it {
       expect(subject.generate_report).to eql(JSON.parse(File.read("#{static_fixture_path}/report-empty.json")))
     }
   end
 
   describe "report should not include finished_catalog_run messages" do
-    subject { YAML.load_file("#{static_fixture_path}/report-2.6.12-noops.yaml").extend(processor) }
+    let(:report) { 'report-2.6.12-noops.yaml' }
+
     it {
       expect(subject.generate_report['logs'].map { |l| l['log']['messages']['message']}.to_s).not_to match(/Finished catalog run in/)
     }
   end
 
   describe "report should not include debug level messages" do
-    subject { YAML.load_file("#{static_fixture_path}/report-2.6.2-debug.yaml").extend(processor) }
+    let(:report) { 'report-2.6.2-debug.yaml' }
+
     it {
       expect(subject.generate_report['logs'].map { |l| l['log']['level']}.to_s).not_to match(/debug/)
     }
   end
 
   describe "report should show failure metrics for failed catalog fetches" do
-    subject { YAML.load_file("#{static_fixture_path}/report-3.5.1-catalog-errors.yaml").extend(processor) }
+    let(:report) { 'report-3.5.1-catalog-errors.yaml' }
+
     it {
       expect(subject.generate_report['status']['failed']).to eql 1
     }
   end
 
   describe "report should properly bypass log processor changes" do
-    subject { YAML.load_file("#{static_fixture_path}/report-log-preprocessed.yaml").extend(processor) }
+    let(:report) { 'report-log-preprocessed.yaml' }
+
     it {
       expect(subject.generate_report['status']['failed']).to eql 1
     }