Merge pull request #11 from bolshakov/feature/safe-loading

Load YAML safely
bolshakov · Oct 21, 2024 · 49ac4dd · 49ac4dd
2 parents 842e266 + 0016d32
commit 49ac4dd
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/lib/config_x/config_factory.rb b/lib/config_x/config_factory.rb
@@ -93,7 +93,7 @@ def setting_files
     # @return [Array] the local setting files.
     def local_setting_files
       [
-        (File.join(config_root, "#{file_name}.local.yml") if env != "test"),
+        File.join(config_root, "#{file_name}.local.yml"),
         File.join(config_root, dir_name, "#{env}.local.yml")
       ].compact
     end

diff --git a/lib/config_x/env_source.rb b/lib/config_x/env_source.rb
@@ -26,7 +26,7 @@ def source
 
         Array(key.split(separator)[1..])
           .reverse_each
-          .reduce(YAML.load(value)) { |acc, k| {k.downcase => acc} }
+          .reduce(YAML.safe_load(value)) { |acc, k| {k.downcase => acc} }
           .tap { DeepMerge.deep_merge!(_1, config) }
       end
     end