diff --git a/.changeset/stale-pumpkins-flash.md b/.changeset/stale-pumpkins-flash.md new file mode 100644 index 0000000000..93a3c8fe25 --- /dev/null +++ b/.changeset/stale-pumpkins-flash.md @@ -0,0 +1,5 @@ +--- +'@primer/view-components': patch +--- + +Replace YAML load with YAML safe load with allowed classes list diff --git a/lib/primer/classify/utilities.rb b/lib/primer/classify/utilities.rb index a4952ce1a8..a386ffb9e3 100644 --- a/lib/primer/classify/utilities.rb +++ b/lib/primer/classify/utilities.rb @@ -7,15 +7,12 @@ module Primer class Classify # Handler for PrimerCSS utility classes loaded from utilities.rake class Utilities - # Load the utilities.yml file. - # Disabling because we want to load symbols, strings, and integers from the .yml file - # rubocop:disable Security/YAMLLoad - UTILITIES = YAML.load( + UTILITIES = YAML.safe_load( File.read( File.join(File.dirname(__FILE__), "./utilities.yml") - ) + ), + permitted_classes: [Symbol] ).freeze - # rubocop:enable Security/YAMLLoad BREAKPOINTS = ["", "-sm", "-md", "-lg", "-xl"].freeze