Replace YAML load with YAML safe load with allowed classes list (#1258)

primer · Aug 1, 2022 · d3880f7 · d3880f7
1 parent 795639a
commit d3880f7
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/.changeset/stale-pumpkins-flash.md b/.changeset/stale-pumpkins-flash.md
@@ -0,0 +1,5 @@
+---
+'@primer/view-components': patch
+---
+
+Replace YAML load with YAML safe load with allowed classes list
diff --git a/lib/primer/classify/utilities.rb b/lib/primer/classify/utilities.rb
@@ -7,15 +7,12 @@ module Primer
   class Classify
     # Handler for PrimerCSS utility classes loaded from utilities.rake
     class Utilities
-      # Load the utilities.yml file.
-      # Disabling because we want to load symbols, strings, and integers from the .yml file
-      # rubocop:disable Security/YAMLLoad
-      UTILITIES = YAML.load(
+      UTILITIES = YAML.safe_load(
         File.read(
           File.join(File.dirname(__FILE__), "./utilities.yml")
-        )
+        ),
+        permitted_classes: [Symbol]
       ).freeze
-      # rubocop:enable Security/YAMLLoad
 
       BREAKPOINTS = ["", "-sm", "-md", "-lg", "-xl"].freeze