Skip to content

Commit d727d57

Browse files
am0o0hmac
authored andcommitted
v4.2 write exact version of yaml.load default loader change
1 parent 40e24b6 commit d727d57

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ruby/ql/lib/codeql/ruby/security/UnsafeDeserializationCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ module UnsafeDeserialization {
7979
* for unsafe deserialization. The `YAML` module is an alias of `Psych` in
8080
* recent versions of Ruby.
8181
* the `this = yamlNode().getAMethodCall("load").getArgument(0)` is safe
82-
* in recent versions of YAML library, so it will be removed in future.
82+
* in psych/yaml library after [v4.0.0](https://github.com/ruby/psych/releases/tag/v4.0.0), so it will be removed in future.
8383
*/
8484
class YamlLoadArgument extends Sink {
8585
YamlLoadArgument() {

0 commit comments

Comments
 (0)