Add bin and edit workflow

bin/gems/safe_yaml-1.0.5/spec/exploit.1.9.2.yaml

@@ -0,0 +1,2 @@
+--- !ruby/object:ExploitableBackDoor
+foo: bar

bin/gems/safe_yaml-1.0.5/spec/exploit.1.9.3.yaml

@@ -0,0 +1,2 @@
+--- !ruby/hash:ExploitableBackDoor
+foo: bar

bin/gems/safe_yaml-1.0.5/spec/issue48.txt

@@ -0,0 +1,20 @@
+---
+title: Blah
+key: value
+---
+
+I'm going to inject a bunch of YAML-looking stuff below and it should all just get ignored.
+
+foo: bar
+
+- foo
+- bar
+
+:foo
+42
+~
+
+---
+text: |
+  Look, I'm another YAML document!
+---

bin/gems/safe_yaml-1.0.5/spec/libyaml_checker_spec.rb

@@ -0,0 +1,69 @@
+require "spec_helper"
+
+describe SafeYAML::LibyamlChecker do
+  describe "check_libyaml_version" do
+    REAL_YAML_ENGINE = SafeYAML::YAML_ENGINE
+    REAL_LIBYAML_VERSION = SafeYAML::LibyamlChecker::LIBYAML_VERSION
+
+    let(:libyaml_patched) { false }
+
+    before :each do
+      allow(SafeYAML::LibyamlChecker).to receive(:libyaml_patched?).and_return(libyaml_patched)
+    end
+
+    after :each do
+      silence_warnings do
+        SafeYAML::YAML_ENGINE = REAL_YAML_ENGINE
+        SafeYAML::LibyamlChecker::LIBYAML_VERSION = REAL_LIBYAML_VERSION
+      end
+    end
+
+    def test_libyaml_version_ok(expected_result, yaml_engine, libyaml_version=nil)
+      silence_warnings do
+        SafeYAML.const_set("YAML_ENGINE", yaml_engine)
+        SafeYAML::LibyamlChecker.const_set("LIBYAML_VERSION", libyaml_version)
+        expect(SafeYAML::LibyamlChecker.libyaml_version_ok?).to eq(expected_result)
+      end
+    end
+
+    unless defined?(JRUBY_VERSION)
+      it "issues no warnings when 'Syck' is the YAML engine" do
+        test_libyaml_version_ok(true, "syck")
+      end
+
+      it "issues a warning if Psych::LIBYAML_VERSION is not defined" do
+        test_libyaml_version_ok(false, "psych")
+      end
+
+      it "issues a warning if Psych::LIBYAML_VERSION is < 0.1.6" do
+        test_libyaml_version_ok(false, "psych", "0.1.5")
+      end
+
+      it "issues no warning if Psych::LIBYAML_VERSION is == 0.1.6" do
+        test_libyaml_version_ok(true, "psych", "0.1.6")
+      end
+
+      it "issues no warning if Psych::LIBYAML_VERSION is > 0.1.6" do
+        test_libyaml_version_ok(true, "psych", "1.0.0")
+      end
+
+      it "does a proper version comparison (not just a string comparison)" do
+        test_libyaml_version_ok(true, "psych", "0.1.10")
+      end
+
+      context "when the system has a known patched libyaml version" do
+        let(:libyaml_patched) { true }
+
+        it "issues no warning, even when Psych::LIBYAML_VERSION < 0.1.6" do
+          test_libyaml_version_ok(true, "psych", "0.1.4")
+        end
+      end
+    end
+
+    if defined?(JRUBY_VERSION)
+      it "issues no warning, as JRuby doesn't use libyaml" do
+        test_libyaml_version_ok(true, "psych", "0.1.4")
+      end
+    end
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/psych_resolver_spec.rb

@@ -0,0 +1,10 @@
+require "spec_helper"
+
+if SafeYAML::YAML_ENGINE == "psych"
+  require "safe_yaml/psych_resolver"
+
+  describe SafeYAML::PsychResolver do
+    include ResolverSpecs
+    let(:resolver) { SafeYAML::PsychResolver.new }
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/resolver_specs.rb

@@ -0,0 +1,278 @@
+module ResolverSpecs
+  def self.included(base)
+    base.module_eval do
+      let(:resolver) { nil }
+      let(:result) { @result }
+
+      before :each do
+        # See the comment in the first before :each block in safe_yaml_spec.rb.
+        require "safe_yaml"
+      end
+
+      def parse(yaml)
+        tree = YAML.parse(yaml.unindent)
+        @result = resolver.resolve_node(tree)
+      end
+
+      # Isn't this how I should've been doing it all along?
+      def parse_and_test(yaml)
+        safe_result = parse(yaml)
+
+        exception_thrown = nil
+
+        unsafe_result = begin
+          YAML.unsafe_load(yaml)
+        rescue Exception => e
+          exception_thrown = e
+        end
+
+        if exception_thrown
+          # If the underlying YAML parser (e.g. Psych) threw an exception, I'm
+          # honestly not sure what the right thing to do is. For now I'll just
+          # print a warning. Should SafeYAML fail when Psych fails?
+          Kernel.warn "\n"
+          Kernel.warn "Discrepancy between SafeYAML and #{SafeYAML::YAML_ENGINE} on input:\n"
+          Kernel.warn "#{yaml.unindent}\n"
+          Kernel.warn "SafeYAML result:"
+          Kernel.warn "#{safe_result.inspect}\n"
+          Kernel.warn "#{SafeYAML::YAML_ENGINE} result:"
+          Kernel.warn "#{exception_thrown.inspect}\n"
+
+        else
+          expect(safe_result).to eq(unsafe_result)
+        end
+      end
+
+      context "by default" do
+        it "translates maps to hashes" do
+          parse <<-YAML
+            potayto: potahto
+            tomayto: tomahto
+          YAML
+
+          expect(result).to eq({
+            "potayto" => "potahto",
+            "tomayto" => "tomahto"
+          })
+        end
+
+        it "translates sequences to arrays" do
+          parse <<-YAML
+            - foo
+            - bar
+            - baz
+          YAML
+
+          expect(result).to eq(["foo", "bar", "baz"])
+        end
+
+        it "translates most values to strings" do
+          parse "string: value"
+          expect(result).to eq({ "string" => "value" })
+        end
+
+        it "does not deserialize symbols" do
+          parse ":symbol: value"
+          expect(result).to eq({ ":symbol" => "value" })
+        end
+
+        it "translates valid integral numbers to integers" do
+          parse "integer: 1"
+          expect(result).to eq({ "integer" => 1 })
+        end
+
+        it "translates valid decimal numbers to floats" do
+          parse "float: 3.14"
+          expect(result).to eq({ "float" => 3.14 })
+        end
+
+        it "translates valid dates" do
+          parse "date: 2013-01-24"
+          expect(result).to eq({ "date" => Date.parse("2013-01-24") })
+        end
+
+        it "translates valid true/false values to booleans" do
+          parse <<-YAML
+            - yes
+            - true
+            - no
+            - false
+          YAML
+
+          expect(result).to eq([true, true, false, false])
+        end
+
+        it "translates valid nulls to nil" do
+          parse <<-YAML
+            - 
+            - ~
+            - null
+          YAML
+
+          expect(result).to eq([nil] * 3)
+        end
+
+        it "matches the behavior of the underlying YAML engine w/ respect to capitalization of boolean values" do
+          parse_and_test <<-YAML
+            - true
+            - True
+            - TRUE
+            - tRue
+            - TRue
+            - False
+            - FALSE
+            - fAlse
+            - FALse
+          YAML
+
+          # using Syck: [true, true, true, "tRue", "TRue", false, false, "fAlse", "FALse"]
+          # using Psych: all booleans
+        end
+
+        it "matches the behavior of the underlying YAML engine w/ respect to capitalization of nil values" do
+          parse_and_test <<-YAML
+            - Null
+            - NULL
+            - nUll
+            - NUll
+          YAML
+
+          # using Syck: [nil, nil, "nUll", "NUll"]
+          # using Psych: all nils
+        end
+
+        it "translates quoted empty strings to strings (not nil)" do
+          parse "foo: ''"
+          expect(result).to eq({ "foo" => "" })
+        end
+
+        it "correctly reverse-translates strings encoded via #to_yaml" do
+          parse "5.10".to_yaml
+          expect(result).to eq("5.10")
+        end
+
+        it "does not specially parse any double-quoted strings" do
+          parse <<-YAML
+            - "1"
+            - "3.14"
+            - "true"
+            - "false"
+            - "2013-02-03"
+            - "2013-02-03 16:27:00 -0600"
+          YAML
+
+          expect(result).to eq(["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"])
+        end
+
+        it "does not specially parse any single-quoted strings" do
+          parse <<-YAML
+            - '1'
+            - '3.14'
+            - 'true'
+            - 'false'
+            - '2013-02-03'
+            - '2013-02-03 16:27:00 -0600'
+          YAML
+
+          expect(result).to eq(["1", "3.14", "true", "false", "2013-02-03", "2013-02-03 16:27:00 -0600"])
+        end
+
+        it "deals just fine with nested maps" do
+          parse <<-YAML
+            foo:
+              bar:
+                marco: polo
+          YAML
+
+          expect(result).to eq({ "foo" => { "bar" => { "marco" => "polo" } } })
+        end
+
+        it "deals just fine with nested sequences" do
+          parse <<-YAML
+            - foo
+            -
+              - bar1
+              - bar2
+              -
+                - baz1
+                - baz2
+          YAML
+
+          expect(result).to eq(["foo", ["bar1", "bar2", ["baz1", "baz2"]]])
+        end
+
+        it "applies the same transformations to keys as to values" do
+          parse <<-YAML
+            foo: string
+            :bar: symbol
+            1: integer
+            3.14: float
+            2013-01-24: date
+          YAML
+
+          expect(result).to eq({
+            "foo"  => "string",
+            ":bar" => "symbol",
+            1      => "integer",
+            3.14   => "float",
+            Date.parse("2013-01-24") => "date",
+          })
+        end
+
+        it "applies the same transformations to elements in sequences as to all values" do
+          parse <<-YAML
+            - foo
+            - :bar
+            - 1
+            - 3.14
+            - 2013-01-24
+          YAML
+
+          expect(result).to eq(["foo", ":bar", 1, 3.14, Date.parse("2013-01-24")])
+        end
+      end
+
+      context "for Ruby version #{RUBY_VERSION}" do
+        it "translates valid time values" do
+          parse "time: 2013-01-29 05:58:00 -0800"
+          expect(result).to eq({ "time" => Time.utc(2013, 1, 29, 13, 58, 0) })
+        end
+
+        it "applies the same transformation to elements in sequences" do
+          parse "- 2013-01-29 05:58:00 -0800"
+          expect(result).to eq([Time.utc(2013, 1, 29, 13, 58, 0)])
+        end
+
+        it "applies the same transformation to keys" do
+          parse "2013-01-29 05:58:00 -0800: time"
+          expect(result).to eq({ Time.utc(2013, 1, 29, 13, 58, 0) => "time" })
+        end
+      end
+
+      context "with symbol deserialization enabled" do
+        before :each do
+          SafeYAML::OPTIONS[:deserialize_symbols] = true
+        end
+
+        after :each do
+          SafeYAML.restore_defaults!
+        end
+
+        it "translates values starting with ':' to symbols" do
+          parse "symbol: :value"
+          expect(result).to eq({ "symbol" => :value })
+        end
+
+        it "applies the same transformation to keys" do
+          parse ":bar: symbol"
+          expect(result).to eq({ :bar  => "symbol" })
+        end
+
+        it "applies the same transformation to elements in sequences" do
+          parse "- :bar"
+          expect(result).to eq([:bar])
+        end
+      end
+    end
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/safe_yaml_spec.rb

@@ -0,0 +1,731 @@
+require "spec_helper"
+
+describe YAML do
+  def safe_load_round_trip(object, options={})
+    yaml = object.to_yaml
+    if SafeYAML::YAML_ENGINE == "psych"
+      YAML.safe_load(yaml, nil, options)
+    else
+      YAML.safe_load(yaml, options)
+    end
+  end
+
+  before :each do
+    # Need to require this here (as opposed to somewhere up higher in the file)
+    # to ensure that safe_yaml isn't loaded and therefore YAML isn't monkey-
+    # patched, for tests that require only safe_yaml/load.
+    require "safe_yaml"
+    require "exploitable_back_door"
+
+    SafeYAML.restore_defaults!
+  end
+
+  after :each do
+    SafeYAML.restore_defaults!
+  end
+
+  describe "unsafe_load" do
+    if SafeYAML::YAML_ENGINE == "psych" && RUBY_VERSION >= "1.9.3"
+      it "allows exploits through objects defined in YAML w/ !ruby/hash via custom :[]= methods" do
+        backdoor = YAML.unsafe_load("--- !ruby/hash:ExploitableBackDoor\nfoo: bar\n")
+        expect(backdoor).to be_exploited_through_setter
+      end
+
+      it "allows exploits through objects defined in YAML w/ !ruby/object via the :init_with method" do
+        backdoor = YAML.unsafe_load("--- !ruby/object:ExploitableBackDoor\nfoo: bar\n")
+        expect(backdoor).to be_exploited_through_init_with
+      end
+    end
+
+    it "allows exploits through objects w/ sensitive instance variables defined in YAML w/ !ruby/object" do
+      backdoor = YAML.unsafe_load("--- !ruby/object:ExploitableBackDoor\nfoo: bar\n")
+      expect(backdoor).to be_exploited_through_ivars
+    end
+
+    context "with special whitelisted tags defined" do
+      before :each do
+        SafeYAML::whitelist!(OpenStruct)
+      end
+
+      it "effectively ignores the whitelist (since everything is whitelisted)" do
+        result = YAML.unsafe_load <<-YAML.unindent
+          --- !ruby/object:OpenStruct 
+          table: 
+            :backdoor: !ruby/object:ExploitableBackDoor 
+              foo: bar
+        YAML
+
+        expect(result).to be_a(OpenStruct)
+        expect(result.backdoor).to be_exploited_through_ivars
+      end
+    end
+  end
+
+  describe "safe_load" do
+    it "does NOT allow exploits through objects defined in YAML w/ !ruby/hash" do
+      object = YAML.safe_load("--- !ruby/hash:ExploitableBackDoor\nfoo: bar\n")
+      expect(object).not_to be_a(ExploitableBackDoor)
+    end
+
+    it "does NOT allow exploits through objects defined in YAML w/ !ruby/object" do
+      object = YAML.safe_load("--- !ruby/object:ExploitableBackDoor\nfoo: bar\n")
+      expect(object).not_to be_a(ExploitableBackDoor)
+    end
+
+    context "for YAML engine #{SafeYAML::YAML_ENGINE}" do
+      if SafeYAML::YAML_ENGINE == "psych"
+        let(:options) { nil }
+        let(:arguments) { ["foo: bar", nil, options] }
+
+        context "when no tags are whitelisted" do
+          it "constructs a SafeYAML::PsychHandler to resolve nodes as they're parsed, for optimal performance" do
+            expect(Psych::Parser).to receive(:new).with an_instance_of(SafeYAML::PsychHandler)
+            # This won't work now; we just want to ensure Psych::Parser#parse was in fact called.
+            YAML.safe_load(*arguments) rescue nil
+          end
+        end
+
+        context "when whitelisted tags are specified" do
+          let(:options) {
+            { :whitelisted_tags => ["foo"] }
+          }
+
+          it "instead uses Psych to construct a full tree before examining the nodes" do
+            expect(Psych).to receive(:parse)
+            # This won't work now; we just want to ensure Psych::Parser#parse was in fact called.
+            YAML.safe_load(*arguments) rescue nil
+          end
+        end
+      end
+
+      if SafeYAML::YAML_ENGINE == "syck"
+        it "uses Syck internally to parse YAML" do
+          expect(YAML).to receive(:parse).with("foo: bar")
+          # This won't work now; we just want to ensure YAML::parse was in fact called.
+          YAML.safe_load("foo: bar") rescue nil
+        end
+      end
+    end
+
+    it "loads a plain ol' YAML document just fine" do
+      result = YAML.safe_load <<-YAML.unindent
+        foo:
+          number: 1
+          boolean: true
+          nil: ~
+          string: Hello, there!
+          symbol: :blah
+          sequence:
+            - hi
+            - bye
+      YAML
+
+      expect(result).to eq({
+        "foo" => {
+          "number"   => 1,
+          "boolean"  => true,
+          "nil"      => nil,
+          "string"   => "Hello, there!",
+          "symbol"   => ":blah",
+          "sequence" => ["hi", "bye"]
+        }
+      })
+    end
+
+    it "works for YAML documents with anchors and aliases" do
+      result = YAML.safe_load <<-YAML
+        - &id001 {}
+        - *id001
+        - *id001
+      YAML
+
+      expect(result).to eq([{}, {}, {}])
+    end
+
+    it "works for YAML documents with binary tagged keys" do
+      result = YAML.safe_load <<-YAML
+        ? !!binary >
+          Zm9v
+        : "bar"
+        ? !!binary >
+          YmFy
+        : "baz"
+      YAML
+
+      expect(result).to eq({"foo" => "bar", "bar" => "baz"})
+    end
+
+    it "works for YAML documents with binary tagged values" do
+      result = YAML.safe_load <<-YAML
+        "foo": !!binary >
+          YmFy
+        "bar": !!binary >
+          YmF6
+      YAML
+
+      expect(result).to eq({"foo" => "bar", "bar" => "baz"})
+    end
+
+    it "works for YAML documents with binary tagged array values" do
+      result = YAML.safe_load <<-YAML
+        - !binary |-
+          Zm9v
+        - !binary |-
+          YmFy
+      YAML
+
+      expect(result).to eq(["foo", "bar"])
+    end
+
+    it "works for YAML documents with sections" do
+      result = YAML.safe_load <<-YAML
+        mysql: &mysql
+          adapter: mysql
+          pool: 30
+        login: &login
+          username: user
+          password: password123
+        development: &development
+          <<: *mysql
+          <<: *login
+          host: localhost
+      YAML
+
+      expect(result).to eq({
+        "mysql" => {
+          "adapter" => "mysql",
+          "pool"    => 30
+        },
+        "login" => {
+          "username" => "user",
+          "password" => "password123"
+        },
+        "development" => {
+          "adapter"  => "mysql",
+          "pool"     => 30,
+          "username" => "user",
+          "password" => "password123",
+          "host"     => "localhost"
+        }
+      })
+    end
+
+    it "correctly prefers explicitly defined values over default values from included sections" do
+      # Repeating this test 100 times to increase the likelihood of running into an issue caused by
+      # non-deterministic hash key enumeration.
+      100.times do
+        result = YAML.safe_load <<-YAML
+          defaults: &defaults
+            foo: foo
+            bar: bar
+            baz: baz
+          custom:
+            <<: *defaults
+            bar: custom_bar
+            baz: custom_baz
+        YAML
+
+        expect(result["custom"]).to eq({
+          "foo" => "foo",
+          "bar" => "custom_bar",
+          "baz" => "custom_baz"
+        })
+      end
+    end
+
+    it "works with multi-level inheritance" do
+      result = YAML.safe_load <<-YAML
+        defaults: &defaults
+          foo: foo
+          bar: bar
+          baz: baz
+        custom: &custom
+          <<: *defaults
+          bar: custom_bar
+          baz: custom_baz
+        grandcustom: &grandcustom
+          <<: *custom
+      YAML
+
+      expect(result).to eq({
+        "defaults"    => { "foo" => "foo", "bar" => "bar", "baz" => "baz" },
+        "custom"      => { "foo" => "foo", "bar" => "custom_bar", "baz" => "custom_baz" },
+        "grandcustom" => { "foo" => "foo", "bar" => "custom_bar", "baz" => "custom_baz" }
+      })
+    end
+
+    it "returns false when parsing an empty document" do
+      expect([
+        YAML.safe_load(""),
+        YAML.safe_load("     "),
+        YAML.safe_load("\n")
+      ]).to eq([false, false, false])
+    end
+
+    it "returns nil when parsing a single value representing nil" do
+      expect([
+        YAML.safe_load("~"),
+        YAML.safe_load("null")
+      ]).to eq([nil, nil])
+    end
+
+    context "with custom initializers defined" do
+      before :each do
+        if SafeYAML::YAML_ENGINE == "psych"
+          SafeYAML::OPTIONS[:custom_initializers] = {
+            "!set" => lambda { Set.new },
+            "!hashiemash" => lambda { Hashie::Mash.new }
+          }
+        else
+          SafeYAML::OPTIONS[:custom_initializers] = {
+            "tag:yaml.org,2002:set" => lambda { Set.new },
+            "tag:yaml.org,2002:hashiemash" => lambda { Hashie::Mash.new }
+          }
+        end
+      end
+
+      it "will use a custom initializer to instantiate an array-like class upon deserialization" do
+        result = YAML.safe_load <<-YAML.unindent
+          --- !set
+          - 1
+          - 2
+          - 3
+        YAML
+
+        expect(result).to be_a(Set)
+        expect(result.to_a).to match_array([1, 2, 3])
+      end
+
+      it "will use a custom initializer to instantiate a hash-like class upon deserialization" do
+        result = YAML.safe_load <<-YAML.unindent
+          --- !hashiemash
+          foo: bar
+        YAML
+
+        expect(result).to be_a(Hashie::Mash)
+        expect(result.to_hash).to eq({ "foo" => "bar" })
+      end
+    end
+
+    context "with special whitelisted tags defined" do
+      before :each do
+        SafeYAML::whitelist!(OpenStruct)
+
+        # Necessary for deserializing OpenStructs properly.
+        SafeYAML::OPTIONS[:deserialize_symbols] = true
+      end
+
+      it "will allow objects to be deserialized for whitelisted tags" do
+        result = YAML.safe_load("--- !ruby/object:OpenStruct\ntable:\n  foo: bar\n")
+        expect(result).to be_a(OpenStruct)
+        expect(result.instance_variable_get(:@table)).to eq({ "foo" => "bar" })
+      end
+
+      it "will not deserialize objects without whitelisted tags" do
+        result = YAML.safe_load("--- !ruby/hash:ExploitableBackDoor\nfoo: bar\n")
+        expect(result).not_to be_a(ExploitableBackDoor)
+        expect(result).to eq({ "foo" => "bar" })
+      end
+
+      it "will not allow non-whitelisted objects to be embedded within objects with whitelisted tags" do
+        result = YAML.safe_load <<-YAML.unindent
+          --- !ruby/object:OpenStruct 
+          table: 
+            :backdoor: !ruby/object:ExploitableBackDoor 
+              foo: bar
+        YAML
+
+        expect(result).to be_a(OpenStruct)
+        expect(result.backdoor).not_to be_a(ExploitableBackDoor)
+        expect(result.backdoor).to eq({ "foo" => "bar" })
+      end
+
+      context "with the :raise_on_unknown_tag option enabled" do
+        before :each do
+          SafeYAML::OPTIONS[:raise_on_unknown_tag] = true
+        end
+
+        after :each do
+          SafeYAML.restore_defaults!
+        end
+
+        it "raises an exception if a non-nil, non-whitelisted tag is encountered" do
+          expect {
+            YAML.safe_load <<-YAML.unindent
+              --- !ruby/object:Unknown
+              foo: bar
+            YAML
+          }.to raise_error
+        end
+
+        it "checks all tags, even those within objects with trusted tags" do
+          expect {
+            YAML.safe_load <<-YAML.unindent
+              --- !ruby/object:OpenStruct
+              table:
+                :backdoor: !ruby/object:Unknown
+                  foo: bar
+            YAML
+          }.to raise_error
+        end
+
+        it "does not raise an exception as long as all tags are whitelisted" do
+          result = YAML.safe_load <<-YAML.unindent
+            --- !ruby/object:OpenStruct
+            table:
+              :backdoor:
+                string: foo
+                integer: 1
+                float: 3.14
+                symbol: :bar
+                date: 2013-02-20
+                array: []
+                hash: {}
+          YAML
+
+          expect(result).to be_a(OpenStruct)
+          expect(result.backdoor).to eq({
+            "string"  => "foo",
+            "integer" => 1,
+            "float"   => 3.14,
+            "symbol"  => :bar,
+            "date"    => Date.parse("2013-02-20"),
+            "array"   => [],
+            "hash"    => {}
+          })
+        end
+
+        it "does not raise an exception on the non-specific '!' tag" do
+          result = nil
+          expect { result = YAML.safe_load "--- ! 'foo'" }.to_not raise_error
+          expect(result).to eq("foo")
+        end
+
+        context "with whitelisted custom class" do
+          class SomeClass
+            attr_accessor :foo
+          end
+          let(:instance) { SomeClass.new }
+
+          before do
+            SafeYAML::whitelist!(SomeClass)
+            instance.foo = 'with trailing whitespace: '
+          end
+
+          it "does not raise an exception on the non-specific '!' tag" do
+            result = nil
+            expect { result = YAML.safe_load(instance.to_yaml) }.to_not raise_error
+            expect(result.foo).to eq('with trailing whitespace: ')
+          end
+        end
+      end
+    end
+
+    context "when options are passed direclty to #load which differ from the defaults" do
+      let(:default_options) { {} }
+
+      before :each do
+        SafeYAML::OPTIONS.merge!(default_options)
+      end
+
+      context "(for example, when symbol deserialization is enabled by default)" do
+        let(:default_options) { { :deserialize_symbols => true } }
+
+        it "goes with the default option when it is not overridden" do
+          silence_warnings do
+            expect(YAML.load(":foo: bar")).to eq({ :foo => "bar" })
+          end
+        end
+
+        it "allows the default option to be overridden on a per-call basis" do
+          silence_warnings do
+            expect(YAML.load(":foo: bar", :deserialize_symbols => false)).to eq({ ":foo" => "bar" })
+            expect(YAML.load(":foo: bar", :deserialize_symbols => true)).to eq({ :foo => "bar" })
+          end
+        end
+      end
+
+      context "(or, for example, when certain tags are whitelisted)" do
+        let(:default_options) {
+          {
+            :deserialize_symbols => true,
+            :whitelisted_tags => SafeYAML::YAML_ENGINE == "psych" ?
+              ["!ruby/object:OpenStruct"] :
+              ["tag:ruby.yaml.org,2002:object:OpenStruct"]
+          }
+        }
+
+        it "goes with the default option when it is not overridden" do
+          result = safe_load_round_trip(OpenStruct.new(:foo => "bar"))
+          expect(result).to be_a(OpenStruct)
+          expect(result.foo).to eq("bar")
+        end
+
+        it "allows the default option to be overridden on a per-call basis" do
+          result = safe_load_round_trip(OpenStruct.new(:foo => "bar"), :whitelisted_tags => [])
+          expect(result).to eq({ "table" => { :foo => "bar" } })
+
+          result = safe_load_round_trip(OpenStruct.new(:foo => "bar"), :deserialize_symbols => false, :whitelisted_tags => [])
+          expect(result).to eq({ "table" => { ":foo" => "bar" } })
+        end
+      end
+    end
+  end
+
+  describe "unsafe_load_file" do
+    if SafeYAML::YAML_ENGINE == "psych" && RUBY_VERSION >= "1.9.3"
+      it "allows exploits through objects defined in YAML w/ !ruby/hash via custom :[]= methods" do
+        backdoor = YAML.unsafe_load_file "spec/exploit.1.9.3.yaml"
+        expect(backdoor).to be_exploited_through_setter
+      end
+    end
+
+    if SafeYAML::YAML_ENGINE == "psych" && RUBY_VERSION >= "1.9.2"
+      it "allows exploits through objects defined in YAML w/ !ruby/object via the :init_with method" do
+        backdoor = YAML.unsafe_load_file "spec/exploit.1.9.2.yaml"
+        expect(backdoor).to be_exploited_through_init_with
+      end
+    end
+
+    it "allows exploits through objects w/ sensitive instance variables defined in YAML w/ !ruby/object" do
+      backdoor = YAML.unsafe_load_file "spec/exploit.1.9.2.yaml"
+      expect(backdoor).to be_exploited_through_ivars
+    end
+  end
+
+  describe "safe_load_file" do
+    it "does NOT allow exploits through objects defined in YAML w/ !ruby/hash" do
+      object = YAML.safe_load_file "spec/exploit.1.9.3.yaml"
+      expect(object).not_to be_a(ExploitableBackDoor)
+    end
+
+    it "does NOT allow exploits through objects defined in YAML w/ !ruby/object" do
+      object = YAML.safe_load_file "spec/exploit.1.9.2.yaml"
+      expect(object).not_to be_a(ExploitableBackDoor)
+    end
+    
+    it "returns false when parsing an empty file" do
+      expect(YAML.safe_load_file("spec/issue49.yml")).to eq(false)
+    end
+  end
+
+  describe "load" do
+    let(:options) { {} }
+
+    let (:arguments) {
+      if SafeYAML::MULTI_ARGUMENT_YAML_LOAD
+        ["foo: bar", nil, options]
+      else
+        ["foo: bar", options]
+      end
+    }
+
+    context "as long as a :default_mode has been specified" do
+      it "doesn't issue a warning for safe mode, since an explicit mode has been set" do
+        SafeYAML::OPTIONS[:default_mode] = :safe
+        expect(Kernel).not_to receive(:warn)
+        YAML.load(*arguments)
+      end
+
+      it "doesn't issue a warning for unsafe mode, since an explicit mode has been set" do
+        SafeYAML::OPTIONS[:default_mode] = :unsafe
+        expect(Kernel).not_to receive(:warn)
+        YAML.load(*arguments)
+      end
+    end
+
+    context "when the :safe options is specified" do
+      let(:safe_mode) { true }
+      let(:options) { { :safe => safe_mode } }
+
+      it "doesn't issue a warning" do
+        expect(Kernel).not_to receive(:warn)
+        YAML.load(*arguments)
+      end
+
+      it "calls #safe_load if the :safe option is set to true" do
+        expect(YAML).to receive(:safe_load)
+        YAML.load(*arguments)
+      end
+
+      context "when the :safe option is set to false" do
+        let(:safe_mode) { false }
+
+        it "calls #unsafe_load if the :safe option is set to false" do
+          expect(YAML).to receive(:unsafe_load)
+          YAML.load(*arguments)
+        end
+      end
+    end
+
+    it "issues a warning when the :safe option is omitted" do
+      silence_warnings do
+        expect(Kernel).to receive(:warn)
+        YAML.load(*arguments)
+      end
+    end
+
+    it "only issues a warning once (to avoid spamming an app's output)" do
+      silence_warnings do
+        expect(Kernel).to receive(:warn).once
+        2.times { YAML.load(*arguments) }
+      end
+    end
+
+    it "defaults to safe mode if the :safe option is omitted" do
+      silence_warnings do
+        expect(YAML).to receive(:safe_load)
+        YAML.load(*arguments)
+      end
+    end
+
+    context "with the default mode set to :unsafe" do
+      before :each do
+        SafeYAML::OPTIONS[:default_mode] = :unsafe
+      end
+
+      it "defaults to unsafe mode if the :safe option is omitted" do
+        silence_warnings do
+          expect(YAML).to receive(:unsafe_load)
+          YAML.load(*arguments)
+        end
+      end
+
+      it "calls #safe_load if the :safe option is set to true" do
+        expect(YAML).to receive(:safe_load)
+        YAML.load(*(arguments + [{ :safe => true }]))
+      end
+    end
+  end
+
+  describe "load_file" do
+    let(:filename) { "spec/exploit.1.9.2.yaml" } # doesn't really matter
+
+    it "issues a warning if the :safe option is omitted" do
+      silence_warnings do
+        expect(Kernel).to receive(:warn)
+        YAML.load_file(filename)
+      end
+    end
+
+    it "doesn't issue a warning as long as the :safe option is specified" do
+      expect(Kernel).not_to receive(:warn)
+      YAML.load_file(filename, :safe => true)
+    end
+
+    it "defaults to safe mode if the :safe option is omitted" do
+      silence_warnings do
+        expect(YAML).to receive(:safe_load_file)
+        YAML.load_file(filename)
+      end
+    end
+
+    it "calls #safe_load_file if the :safe option is set to true" do
+      expect(YAML).to receive(:safe_load_file)
+      YAML.load_file(filename, :safe => true)
+    end
+
+    it "calls #unsafe_load_file if the :safe option is set to false" do
+      expect(YAML).to receive(:unsafe_load_file)
+      YAML.load_file(filename, :safe => false)
+    end
+
+    context "with arbitrary object deserialization enabled by default" do
+      before :each do
+        SafeYAML::OPTIONS[:default_mode] = :unsafe
+      end
+
+      it "defaults to unsafe mode if the :safe option is omitted" do
+        silence_warnings do
+          expect(YAML).to receive(:unsafe_load_file)
+          YAML.load_file(filename)
+        end
+      end
+
+      it "calls #safe_load if the :safe option is set to true" do
+        expect(YAML).to receive(:safe_load_file)
+        YAML.load_file(filename, :safe => true)
+      end
+    end
+
+    it "handles files starting with --- (see issue #48)" do
+      expect(YAML.load_file("spec/issue48.txt", :safe => true)).to eq({
+        "title" => "Blah",
+        "key"   => "value"
+      })
+    end
+
+    it "handles content starting with --- (see issue #48)" do
+      yaml = File.read("spec/issue48.txt")
+      expect(YAML.load(yaml, :safe => true)).to eq({
+        "title" => "Blah",
+        "key"   => "value"
+      })
+    end
+  end
+
+  describe "whitelist!" do
+    context "not a class" do
+      it "should raise" do
+        expect { SafeYAML::whitelist! :foo }.to raise_error(/not a Class/)
+        expect(SafeYAML::OPTIONS[:whitelisted_tags]).to be_empty
+      end
+    end
+
+    context "anonymous class" do
+      it "should raise" do
+        expect { SafeYAML::whitelist! Class.new }.to raise_error(/cannot be anonymous/)
+        expect(SafeYAML::OPTIONS[:whitelisted_tags]).to be_empty
+      end
+    end
+
+    context "with a Class as its argument" do
+      it "should configure correctly" do
+        expect { SafeYAML::whitelist! OpenStruct }.to_not raise_error
+        expect(SafeYAML::OPTIONS[:whitelisted_tags].grep(/OpenStruct\Z/)).not_to be_empty
+      end
+
+      it "successfully deserializes the specified class" do
+        SafeYAML.whitelist!(OpenStruct)
+
+        # necessary for properly assigning OpenStruct attributes
+        SafeYAML::OPTIONS[:deserialize_symbols] = true
+
+        result = safe_load_round_trip(OpenStruct.new(:foo => "bar"))
+        expect(result).to be_a(OpenStruct)
+        expect(result.foo).to eq("bar")
+      end
+
+      it "works for ranges" do
+        SafeYAML.whitelist!(Range)
+        expect(safe_load_round_trip(1..10)).to eq(1..10)
+      end
+
+      it "works for regular expressions" do
+        SafeYAML.whitelist!(Regexp)
+        expect(safe_load_round_trip(/foo/)).to eq(/foo/)
+      end
+
+      it "works for multiple classes" do
+        SafeYAML.whitelist!(Range, Regexp)
+        expect(safe_load_round_trip([(1..10), /bar/])).to eq([(1..10), /bar/])
+      end
+
+      it "works for arbitrary Exception subclasses" do
+        class CustomException < Exception
+          attr_reader :custom_message
+
+          def initialize(custom_message)
+            @custom_message = custom_message
+          end
+        end
+
+        SafeYAML.whitelist!(CustomException)
+
+        ex = safe_load_round_trip(CustomException.new("blah"))
+        expect(ex).to be_a(CustomException)
+        expect(ex.custom_message).to eq("blah")
+      end
+    end
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/spec_helper.rb

@@ -0,0 +1,42 @@
+HERE = File.dirname(__FILE__) unless defined?(HERE)
+ROOT = File.join(HERE, "..") unless defined?(ROOT)
+
+$LOAD_PATH << File.join(ROOT, "lib")
+$LOAD_PATH << File.join(HERE, "support")
+
+require "yaml"
+if ENV["YAMLER"] && defined?(YAML::ENGINE)
+  YAML::ENGINE.yamler = ENV["YAMLER"]
+end
+
+ruby_version = defined?(JRUBY_VERSION) ? "JRuby #{JRUBY_VERSION} in #{RUBY_VERSION} mode" : "Ruby #{RUBY_VERSION}"
+yaml_engine = defined?(YAML::ENGINE) ? YAML::ENGINE.yamler : "syck"
+libyaml_version = yaml_engine == "psych" && Psych.const_defined?("LIBYAML_VERSION", false) ? Psych::LIBYAML_VERSION : "N/A"
+
+env_info = [
+  ruby_version,
+  "YAML: #{yaml_engine} (#{YAML::VERSION}) (libyaml: #{libyaml_version})",
+  "Monkeypatch: #{ENV['MONKEYPATCH_YAML']}"
+]
+
+puts env_info.join(", ")
+
+# Caching references to these methods before loading safe_yaml in order to test
+# that they aren't touched unless you actually require safe_yaml (see yaml_spec.rb).
+ORIGINAL_YAML_LOAD      = YAML.method(:load)
+ORIGINAL_YAML_LOAD_FILE = YAML.method(:load_file)
+
+require "safe_yaml/load"
+require "ostruct"
+require "hashie"
+require "heredoc_unindent"
+
+# Stolen from Rails:
+# https://github.com/rails/rails/blob/3-2-stable/activesupport/lib/active_support/core_ext/kernel/reporting.rb#L10-25
+def silence_warnings
+  $VERBOSE = nil; yield
+ensure
+  $VERBOSE = true
+end
+
+require File.join(HERE, "resolver_specs")

bin/gems/safe_yaml-1.0.5/spec/store_spec.rb

@@ -0,0 +1,57 @@
+require 'spec_helper'
+
+require 'safe_yaml/store'
+
+describe SafeYAML::Store do
+
+  let(:file)    { 'spec/store.yaml' }
+  let(:content) { "--- \nfoo: 42\n:bar: \"party\"\n" }
+
+  before do
+    # Rewrite file on every test, as its contents are potentially modified by
+    # SafeYAML::Store#transaction
+    File.open(file, 'w') { |f| f.write(content) }
+  end
+
+  def expect_safe_load(options = {})
+    load_args = [content, options]
+    load_args.insert(1, nil) if SafeYAML::YAML_ENGINE == 'psych'
+
+    expect(SafeYAML).to receive(:load).with(*load_args).and_call_original
+    expect(YAML).not_to receive(:load)
+  end
+
+  let(:init_args) { [file] }
+  subject { described_class.new(*init_args) }
+
+  it 'should be a YAML::Store' do
+    expect(subject).to be_a(YAML::Store)
+  end
+
+  it 'should be a SafeYAML::Store' do
+    expect(subject).to be_a(SafeYAML::Store)
+  end
+
+  it 'should use SafeYAML.load instead of YAML.load' do
+    expect_safe_load
+    expect(subject.transaction { subject['foo'] }).to eq(42)
+  end
+
+  it 'preserves default SafeYAML behavior' do
+    expect(subject.transaction { subject[:bar] }).to eq(nil)
+    expect(subject.transaction { subject[':bar'] }).to eq('party')
+  end
+
+
+  describe 'with options' do
+
+    let(:init_args) { super().insert(2, :deserialize_symbols => true) }
+
+    it 'should accept options for SafeYAML.load' do
+      expect_safe_load(:deserialize_symbols => true)
+      expect(subject.transaction { subject[:bar] }).to eq('party')
+    end
+
+  end
+
+end

bin/gems/safe_yaml-1.0.5/spec/support/exploitable_back_door.rb

@@ -0,0 +1,29 @@
+class ExploitableBackDoor
+  def exploited?
+    @exploited_through_setter || @exploited_through_init_with || @exploited_through_ivars
+  end
+
+  def exploited_through_setter?
+    @exploited_through_setter
+  end
+
+  def exploited_through_init_with?
+    @exploited_through_init_with
+  end
+
+  def exploited_through_ivars?
+    self.instance_variables.any?
+  end
+
+  def init_with(command)
+    # Note: this is how bad this COULD be.
+    # system("#{command}")
+    @exploited_through_init_with = true
+  end
+
+  def []=(command, arguments)
+    # Note: this is how bad this COULD be.
+    # system("#{command} #{arguments}")
+    @exploited_through_setter = true
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/syck_resolver_spec.rb

@@ -0,0 +1,10 @@
+require "spec_helper"
+
+if SafeYAML::YAML_ENGINE == "syck"
+  require "safe_yaml/syck_resolver"
+
+  describe SafeYAML::SyckResolver do
+    include ResolverSpecs
+    let(:resolver) { SafeYAML::SyckResolver.new }
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/transform/base64_spec.rb

@@ -0,0 +1,11 @@
+require "spec_helper"
+
+describe SafeYAML::Transform do
+  it "should return the same encoding when decoding Base64" do
+    value = "c3VyZS4="
+    decoded = SafeYAML::Transform.to_proper_type(value, false, "!binary")
+
+    expect(decoded).to eq("sure.")
+    expect(decoded.encoding).to eq(value.encoding) if decoded.respond_to?(:encoding)
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/transform/to_date_spec.rb

@@ -0,0 +1,60 @@
+require "spec_helper"
+
+describe SafeYAML::Transform::ToDate do
+  it "returns true when the value matches a valid Date" do
+    expect(subject.transform?("2013-01-01")).to eq([true, Date.parse("2013-01-01")])
+  end
+
+  it "returns false when the value does not match a valid Date" do
+    expect(subject.transform?("foobar")).to be_falsey
+  end
+
+  it "returns false when the value does not end with a Date" do
+    expect(subject.transform?("2013-01-01\nNOT A DATE")).to be_falsey
+  end
+
+  it "returns false when the value does not begin with a Date" do
+    expect(subject.transform?("NOT A DATE\n2013-01-01")).to be_falsey
+  end
+
+  it "correctly parses the remaining formats of the YAML spec" do
+    equivalent_values = [
+      "2001-12-15T02:59:43.1Z", # canonical
+      "2001-12-14t21:59:43.10-05:00", # iso8601
+      "2001-12-14 21:59:43.10 -5", # space separated
+      "2001-12-15 2:59:43.10" # no time zone (Z)
+    ]
+
+    equivalent_values.each do |value|
+      success, result = subject.transform?(value)
+      expect(success).to be_truthy
+      expect(result).to eq(Time.utc(2001, 12, 15, 2, 59, 43, 100000))
+    end
+  end
+
+  it "converts times to the local timezone" do
+    success, result = subject.transform?("2012-12-01 10:33:45 +11:00")
+    expect(success).to be_truthy
+    expect(result).to eq(Time.utc(2012, 11, 30, 23, 33, 45))
+    expect(result.gmt_offset).to eq(Time.local(2012, 11, 30).gmt_offset)
+  end
+
+  it "returns strings for invalid dates" do
+    expect(subject.transform?("0000-00-00")).to eq([true, "0000-00-00"])
+    expect(subject.transform?("2013-13-01")).to eq([true, "2013-13-01"])
+    expect(subject.transform?("2014-01-32")).to eq([true, "2014-01-32"])
+  end
+
+  it "returns strings for invalid date/times" do
+    expect(subject.transform?("0000-00-00 00:00:00 -0000")).to eq([true, "0000-00-00 00:00:00 -0000"])
+    expect(subject.transform?("2013-13-01 21:59:43 -05:00")).to eq([true, "2013-13-01 21:59:43 -05:00"])
+    expect(subject.transform?("2013-01-32 21:59:43 -05:00")).to eq([true, "2013-01-32 21:59:43 -05:00"])
+    expect(subject.transform?("2013-01-30 25:59:43 -05:00")).to eq([true, "2013-01-30 25:59:43 -05:00"])
+    expect(subject.transform?("2013-01-30 21:69:43 -05:00")).to eq([true, "2013-01-30 21:69:43 -05:00"])
+
+    # Interesting. It seems that in some older Ruby versions, the below actually parses successfully
+    # w/ DateTime.parse; but it fails w/ YAML.load. Whom to follow???
+
+    # subject.transform?("2013-01-30 21:59:63 -05:00").should == [true, "2013-01-30 21:59:63 -05:00"]
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/transform/to_float_spec.rb

@@ -0,0 +1,42 @@
+require "spec_helper"
+
+describe SafeYAML::Transform::ToFloat do
+  it "returns true when the value matches a valid Float" do
+    expect(subject.transform?("20.00")).to eq([true, 20.0])
+  end
+
+  it "returns false when the value does not match a valid Float" do
+    expect(subject.transform?("foobar")).to be_falsey
+  end
+
+  it "returns false when the value spans multiple lines" do
+    expect(subject.transform?("20.00\nNOT A FLOAT")).to be_falsey
+  end
+
+  it "correctly parses all formats in the YAML spec" do
+    # canonical
+    expect(subject.transform?("6.8523015e+5")).to eq([true, 685230.15])
+
+    # exponentioal
+    expect(subject.transform?("685.230_15e+03")).to eq([true, 685230.15])
+
+    # fixed
+    expect(subject.transform?("685_230.15")).to eq([true, 685230.15])
+
+    # sexagesimal
+    expect(subject.transform?("190:20:30.15")).to eq([true, 685230.15])
+
+    # infinity
+    expect(subject.transform?("-.inf")).to eq([true, (-1.0 / 0.0)])
+
+    # not a number
+    # NOTE: can't use == here since NaN != NaN
+    success, result = subject.transform?(".NaN")
+    expect(success).to be_truthy; expect(result).to be_nan
+  end
+
+  # issue 29
+  it "returns false for the string '.'" do
+    expect(subject.transform?(".")).to be_falsey
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/transform/to_integer_spec.rb

@@ -0,0 +1,64 @@
+require "spec_helper"
+
+describe SafeYAML::Transform::ToInteger do
+  it "returns true when the value matches a valid Integer" do
+    expect(subject.transform?("10")).to eq([true, 10])
+  end
+
+  it "returns false when the value does not match a valid Integer" do
+    expect(subject.transform?("foobar")).to be_falsey
+  end
+
+  it "returns false when the value spans multiple lines" do
+    expect(subject.transform?("10\nNOT AN INTEGER")).to be_falsey
+  end
+
+  it "allows commas in the number" do
+    expect(subject.transform?("1,000")).to eq([true, 1000])
+  end
+
+  it "correctly parses numbers in octal format" do
+    expect(subject.transform?("010")).to eq([true, 8])
+  end
+
+  it "correctly parses numbers in hexadecimal format" do
+    expect(subject.transform?("0x1FF")).to eq([true, 511])
+  end
+
+  it "defaults to a string for a number that resembles octal format but is not" do
+    expect(subject.transform?("09")).to be_falsey
+  end
+
+  it "correctly parses 0 in decimal" do
+    expect(subject.transform?("0")).to eq([true, 0])
+  end
+
+  it "defaults to a string for a number that resembles hexadecimal format but is not" do
+    expect(subject.transform?("0x1G")).to be_falsey
+  end
+
+  it "correctly parses all formats in the YAML spec" do
+    # canonical
+    expect(subject.transform?("685230")).to eq([true, 685230])
+
+    # decimal
+    expect(subject.transform?("+685_230")).to eq([true, 685230])
+
+    # octal
+    expect(subject.transform?("02472256")).to eq([true, 685230])
+
+    # hexadecimal:
+    expect(subject.transform?("0x_0A_74_AE")).to eq([true, 685230])
+
+    # binary
+    expect(subject.transform?("0b1010_0111_0100_1010_1110")).to eq([true, 685230])
+
+    # sexagesimal
+    expect(subject.transform?("190:20:30")).to eq([true, 685230])
+  end
+
+  # see https://github.com/dtao/safe_yaml/pull/51
+  it "strips out underscores before parsing decimal values" do
+    expect(subject.transform?("_850_")).to eq([true, 850])
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/transform/to_symbol_spec.rb

@@ -0,0 +1,51 @@
+require "spec_helper"
+
+describe SafeYAML::Transform::ToSymbol do
+  def with_symbol_deserialization_value(value)
+    symbol_deserialization_flag = SafeYAML::OPTIONS[:deserialize_symbols]
+    SafeYAML::OPTIONS[:deserialize_symbols] = value
+
+    yield
+
+  ensure
+    SafeYAML::OPTIONS[:deserialize_symbols] = symbol_deserialization_flag
+  end
+
+  def with_symbol_deserialization(&block)
+    with_symbol_deserialization_value(true, &block)
+  end
+
+  def without_symbol_deserialization(&block)
+    with_symbol_deserialization_value(false, &block)
+  end
+
+  it "returns true when the value matches a valid Symbol" do
+    with_symbol_deserialization { expect(subject.transform?(":foo")[0]).to be_truthy }
+  end
+
+  it "returns true when the value matches a valid String+Symbol" do
+    with_symbol_deserialization { expect(subject.transform?(':"foo"')[0]).to be_truthy }
+  end
+
+  it "returns true when the value matches a valid String+Symbol with 's" do
+    with_symbol_deserialization { expect(subject.transform?(":'foo'")[0]).to be_truthy }
+  end
+
+  it "returns true when the value has special characters and is wrapped in a String" do
+    with_symbol_deserialization { expect(subject.transform?(':"foo.bar"')[0]).to be_truthy }
+  end
+
+  it "returns false when symbol deserialization is disabled" do
+    without_symbol_deserialization { expect(subject.transform?(":foo")).to be_falsey }
+  end
+
+  it "returns false when the value does not match a valid Symbol" do
+    with_symbol_deserialization { expect(subject.transform?("foo")).to be_falsey }
+  end
+
+  it "returns false when the symbol does not begin the line" do
+    with_symbol_deserialization do
+      expect(subject.transform?("NOT A SYMBOL\n:foo")).to be_falsey
+    end
+  end
+end

bin/gems/safe_yaml-1.0.5/spec/yaml_spec.rb

@@ -0,0 +1,15 @@
+# See https://github.com/dtao/safe_yaml/issues/47
+
+require "spec_helper"
+
+describe YAML do
+  context "when you've only required safe_yaml/load", :libraries => true do
+    it "YAML.load doesn't get monkey patched" do
+      expect(YAML.method(:load)).to eq(ORIGINAL_YAML_LOAD)
+    end
+
+    it "YAML.load_file doesn't get monkey patched" do
+      expect(YAML.method(:load_file)).to eq(ORIGINAL_YAML_LOAD_FILE)
+    end
+  end
+end