Merge pull request #11 from bolshakov/feature/safe-loading

Load YAML safely
bolshakov · Oct 21, 2024 · 0fe45a6 · 0fe45a6
2 parents 842e266 + 0016d32
commit 0fe45a6
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    configx (0.5.0)
+    configx (0.6.0)
       deep_merge
       zeitwerk
 

diff --git a/lib/config_x/config_factory.rb b/lib/config_x/config_factory.rb
@@ -93,7 +93,7 @@ def setting_files
     # @return [Array] the local setting files.
     def local_setting_files
       [
-        (File.join(config_root, "#{file_name}.local.yml") if env != "test"),
+        File.join(config_root, "#{file_name}.local.yml"),
         File.join(config_root, dir_name, "#{env}.local.yml")
       ].compact
     end

diff --git a/lib/config_x/env_source.rb b/lib/config_x/env_source.rb
@@ -26,7 +26,7 @@ def source
 
         Array(key.split(separator)[1..])
           .reverse_each
-          .reduce(YAML.load(value)) { |acc, k| {k.downcase => acc} }
+          .reduce(YAML.safe_load(value)) { |acc, k| {k.downcase => acc} }
           .tap { DeepMerge.deep_merge!(_1, config) }
       end
     end

diff --git a/lib/config_x/version.rb b/lib/config_x/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ConfigX
-  VERSION = "0.5.0"
+  VERSION = "0.6.0"
 end