Safe YAML loading.

Allow only Time among primitives.

Author: mostlyobvious

lib/nanoc/github.rb

@@ -27,7 +27,7 @@ def client
       def decode(content)
         content   = Base64.decode64(content)
         matchdata = content.match(REGEX)
-        metadata  = matchdata ? YAML.load(matchdata[:metadata]) : {}
+        metadata  = matchdata ? YAML.safe_load(matchdata[:metadata], permitted_classes: [Time]) : {}
 
         [metadata, content.gsub(REGEX, '')]
       end