Autoload Rails Models unless called from safe_load

[jrafanie]

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1789153

Psych::ClassLoader::Restricted is the class_loader if you use safe_load and was
added in psych 2.0.0:
ruby/psych@2c644e1

Note, ruby 2.4.0 shipped with psych 2.2.2+. This class_loader would not work with ruby 2.3 and older.

From the BZ:

Steps to Reproduce:

1. bundle exec rails c
2. YAML.load("--- !ruby/object:PidFile {}\n")
3. exit console and do step 1 again
4. YAML.safe_load("--- !ruby/object:PidFile {}\n")

Actual results:

$ bundle exec rails c
...
irb(main):001:0> defined?(PidFile)
=> nil
irb(main):002:0> YAML.load("--- !ruby/object:PidFile {}\n")
=> #<PidFile:0x00007fd988e9b718>

$ bundle exec rails c
...
irb(main):001:0> defined?(PidFile)
=> nil
irb(main):002:0> YAML.safe_load("--- !ruby/object:PidFile {}\n")
=> #<PidFile:0x00007f9ba73d5a28>

This should have failed ^^^

Expected results:

$ bundle exec rails c
...
irb(main):001:0> defined?(PidFile)
=> nil
irb(main):002:0> YAML.load("--- !ruby/object:PidFile {}\n")
=> #<PidFile:0x00007f9d55bdd8b0>

$ bundle exec rails c
...
irb(main):001:0> defined?(PidFile)
=> nil
irb(main):002:0> YAML.safe_load("--- !ruby/object:PidFile {}\n")
Traceback (most recent call last):
       16: from railties (5.1.7) lib/rails/commands/console/console_command.rb:17:in `start'
        ...
        1: from /Users/joerafaniello/.rubies/ruby-2.6.5/lib/ruby/2.6.0/psych/class_loader.rb:97:in `find'
Psych::DisallowedClass (Tried to load unspecified class: PidFile)

This is what should be happening ^^^

[miq-bot]

Checked commits jrafanie/manageiq@85adac0~...11a69b5 with ruby 2.5.5, rubocop 0.69.0, haml-lint 0.20.0, and yamllint 1.10.0
3 files checked, 3 offenses detected

spec/initializers/yaml_autoloader_spec.rb

• ❗ - Line 26, Col 17 - Security/YAMLLoad - Prefer using YAML.safe_load over YAML.load.

spec/lib/rbac/filterer_spec.rb

• ❗ - Line 2243, Col 20 - Security/YAMLLoad - Prefer using YAML.safe_load over YAML.load.
• ❗ - Line 2272, Col 20 - Security/YAMLLoad - Prefer using YAML.safe_load over YAML.load.