Merge pull request #11974 from CocoaPods/use_safe_load_yaml

Use `safe_load` during custom YAML config loading
CocoaPods · Jul 3, 2023 · 400f290 · 400f290
2 parents 7234edf + 6bddd9f
commit 400f290
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -14,7 +14,9 @@ To install release candidates run `[sudo] gem install cocoapods --pre`
 
 ##### Bug Fixes
 
-* None.  
+* Use safe_load during custom YAML config loading.  
+  [Dimitris Koutsogiorgas](https://github.com/dnkoutso)
+  [#11974](https://github.com/CocoaPods/CocoaPods/pull/11974)
 
 
 ## 1.12.1 (2023-04-18)

diff --git a/lib/cocoapods/config.rb b/lib/cocoapods/config.rb
@@ -111,7 +111,8 @@ def initialize(use_user_settings = true)
 
       if use_user_settings && user_settings_file.exist?
         require 'yaml'
-        user_settings = YAML.load_file(user_settings_file)
+        user_settings_contents = File.read(user_settings_file)
+        user_settings = YAML.safe_load(user_settings_contents)
         configure_with(user_settings)
       end