safe_load

Safely load the yaml string in yaml. By default, only the following classes are allowed to be deserialized:

• TrueClass

• FalseClass

• NilClass

• Numeric

• String

• Array

• Hash

Recursive data structures are not allowed by default. Arbitrary classes can be allowed by adding those classes to the whitelist. They are additive. For example, to allow Date deserialization:

Psych.safe_load(yaml, [Date])

Now the Date class can be loaded in addition to the classes listed above.

Aliases can be explicitly allowed by changing the aliases parameter. For example:

x = []
x << x
yaml = Psych.dump x
Psych.safe_load yaml               # => raises an exception
Psych.safe_load yaml, [], [], true # => loads the aliases

A Psych::DisallowedClass exception will be raised if the yaml contains a class that isn’t in the whitelist.

A Psych::BadAlias exception will be raised if the yaml contains aliases but the aliases parameter is set to false.