From 2ba37d24e8f8c7858a3db9df5fa9d1a1cb39181a Mon Sep 17 00:00:00 2001 From: Hiroshi SHIBATA Date: Fri, 28 Mar 2025 12:02:59 +0900 Subject: [PATCH] spec/mspec/tool/wrap_with_guard.rb 'ruby_version_is ...3.5' spec/ruby/security/cve_2020_10663_spec.rb --- spec/ruby/security/cve_2020_10663_spec.rb | 79 ++++++++++++----------- 1 file changed, 41 insertions(+), 38 deletions(-) diff --git a/spec/ruby/security/cve_2020_10663_spec.rb b/spec/ruby/security/cve_2020_10663_spec.rb index 03f004efeb..80e860348b 100644 --- a/spec/ruby/security/cve_2020_10663_spec.rb +++ b/spec/ruby/security/cve_2020_10663_spec.rb @@ -1,46 +1,49 @@ require_relative '../spec_helper' -require 'json' -module JSONSpecs - class MyClass - def initialize(foo) - @foo = foo - end +ruby_version_is ""..."3.5" do + require 'json' - def self.json_create(hash) - new(*hash['args']) - end - - def to_json(*args) - { 'json_class' => self.class.name, 'args' => [ @foo ] }.to_json(*args) - end - end -end - -guard -> { - JSON.const_defined?(:Pure) or - version_is(JSON::VERSION, '2.3.0') -} do - describe "CVE-2020-10663 is resisted by" do - it "only creating custom objects if passed create_additions: true or using JSON.load" do - obj = JSONSpecs::MyClass.new("bar") - JSONSpecs::MyClass.should.json_creatable? - json = JSON.dump(obj) - - JSON.parse(json, create_additions: true).class.should == JSONSpecs::MyClass - JSON(json, create_additions: true).class.should == JSONSpecs::MyClass - if version_is(JSON::VERSION, '2.8.0') - warning = /\Wcreate_additions:\s*true\W\s+is\s+deprecated/ - else - warning = '' + module JSONSpecs + class MyClass + def initialize(foo) + @foo = foo end - -> { - JSON.load(json).class.should == JSONSpecs::MyClass - }.should output_to_fd(warning, STDERR) - JSON.parse(json).class.should == Hash - JSON.parse(json, nil).class.should == Hash - JSON(json).class.should == Hash + def self.json_create(hash) + new(*hash['args']) + end + + def to_json(*args) + { 'json_class' => self.class.name, 'args' => [ @foo ] }.to_json(*args) + end + end + end + + guard -> { + JSON.const_defined?(:Pure) or + version_is(JSON::VERSION, '2.3.0') + } do + describe "CVE-2020-10663 is resisted by" do + it "only creating custom objects if passed create_additions: true or using JSON.load" do + obj = JSONSpecs::MyClass.new("bar") + JSONSpecs::MyClass.should.json_creatable? + json = JSON.dump(obj) + + JSON.parse(json, create_additions: true).class.should == JSONSpecs::MyClass + JSON(json, create_additions: true).class.should == JSONSpecs::MyClass + if version_is(JSON::VERSION, '2.8.0') + warning = /\Wcreate_additions:\s*true\W\s+is\s+deprecated/ + else + warning = '' + end + -> { + JSON.load(json).class.should == JSONSpecs::MyClass + }.should output_to_fd(warning, STDERR) + + JSON.parse(json).class.should == Hash + JSON.parse(json, nil).class.should == Hash + JSON(json).class.should == Hash + end end end end