Merge pull request #741 from jaysoffian/patch-1

[YAMLHelper] Handle YAML timestamps
CocoaPods · Apr 25, 2023 · 8428ea5 · 8428ea5
2 parents 0122659 + 3d6b51b
commit 8428ea5
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 3 deletions.
diff --git a/lib/cocoapods-core/yaml_helper.rb b/lib/cocoapods-core/yaml_helper.rb
@@ -54,7 +54,7 @@ def convert_hash(value, hash_keys_hint, line_separator = "\n")
       # @return [Hash, Array] the Ruby YAML representaton
       #
       def load_string(yaml_string, file_path = nil)
-        YAML.load(yaml_string)
+        YAML.safe_load(yaml_string, :permitted_classes => [Date, Time, Symbol])
       rescue
         if yaml_has_merge_error?(yaml_string)
           raise Informative, yaml_merge_conflict_msg(yaml_string, file_path)
@@ -284,6 +284,17 @@ def sorting_string(value)
         'true', 'True', 'TRUE', 'false', 'False', 'FALSE', # bool
         'yes', 'Yes', 'YES', 'no', 'No', 'NO', # yes/no
         'on', 'On', 'ON', 'off', 'Off', 'OFF', # no/off
+        Regexp.new(%{
+          [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] # (ymd)
+         |[0-9][0-9][0-9][0-9] # (year)
+          -[0-9][0-9]? # (month)
+          -[0-9][0-9]? # (day)
+          ([Tt]|[ \t]+)[0-9][0-9]? # (hour)
+          :[0-9][0-9] # (minute)
+          :[0-9][0-9] # (second)
+          (\.[0-9]*)? # (fraction)
+          (([ \t]*)(Z|[-+][0-9][0-9]?(:[0-9][0-9])?))? # (time zone)
+        }, Regexp::EXTENDED), # https://yaml.org/type/timestamp.html
         /[-+]?[0-9]+/, # base 10 int
         /00[0-7]+/, # base 8 int
         /0x[0-9a-fA-F]+/, # base 16 int

diff --git a/spec/yaml_helper_spec.rb b/spec/yaml_helper_spec.rb
@@ -39,6 +39,21 @@ module Pod
         YAMLHelper.load_string(result).should == value
       end
 
+      it 'converts strings that look like YAML timestamps' do
+        {
+          # https://yaml.org/type/timestamp.html
+          '2001-12-15T02:59:43.1Z' => "'2001-12-15T02:59:43.1Z'",
+          '2001-12-14t21:59:43.10-05:00' => "'2001-12-14t21:59:43.10-05:00'",
+          '2001-12-14 21:59:43.10 -5' => "'2001-12-14 21:59:43.10 -5'",
+          '2001-12-15 2:59:43.10' => "'2001-12-15 2:59:43.10'",
+          '2002-12-14' => "'2002-12-14'",
+        }.each do |given, expected|
+          converted = YAMLHelper.convert(given)
+          converted[0..-2].should == expected
+          YAMLHelper.load_string("---\n#{converted}").should == given
+        end
+      end
+
       it 'converts weird strings' do
         {
           'true' => "'true'",
@@ -176,14 +191,16 @@ module Pod
         YAMLHelper.load_string(result).should == value
       end
 
-      it 'handles objects of unknown classes' do
+      it 'raises an Informative error when it encounters a disallowed class' do
         value = Pathname.new('a-path')
         result = YAMLHelper.convert(value)
         result.should == <<-EOT.strip_heredoc
           !ruby/object:Pathname
           path: a-path
         EOT
-        YAMLHelper.load_string(result).should == value
+        should.raise Informative do
+          YAMLHelper.load_string(result)
+        end
       end
     end