Psych::DisallowedClass while updating a rails ActiveModel entry

Question

This is a little weird, I am trying to update an ActiveModel entry via rails_admin console and updating any attribute on the model throws the error Psych::DisallowedClass. Looks to me like the error is only thrown when the Model has some serialized fields. I am not sure how the Psych library gets in the serialization scene under the hood, so looking for some pointers here.

Thanks!

score 6 · Answer 1 · answered Jul 20 '22 at 10:26

6

I ran into the same problem after updating from rails 5.2.5 to 5.2.8.

I solved it by adding

config.active_record.yaml_column_permitted_classes = [Symbol]

in my config/application.rb.

answered Jul 20 '22 at 10:26

puclanac

114
1
4

I see it was now added as a default https://github.com/rails/rails/pull/45584/files – puclanac Jul 20 '22 at 10:33

Малъ Скрылевъ · Answer 2 · 2022-07-14T07:37:16.437

-2

From gem version psych 4.0, there are the strict approach for parsing the YAML files. So either use older versions of psych, pass the permitted_classes args to the #load method to allow the class, which you've got the exception for:

YAML.load(txt, permitted_classes: [Gem::Specification, Symbol])

The code is required to load YAML document with a specific non standard classes. Because loader prevents user from loading some unsafe classes. More information can be inferred from the sources of YAML.

edited Jul 14 '22 at 07:37

answered Jul 25 '21 at 22:49

Малъ Скрылевъ

16,187
5
56
69

Where to write this? – Rajesh Paul Feb 11 '22 at 11:37
@RajeshPaul instead of YAML.load – Малъ Скрылевъ Feb 18 '22 at 21:46
This is when calling `serialize` not `YAML.load` – Carl Jul 13 '22 at 19:26
@Carl yaml load prevents user from loading some classes, so this required, please look at their sources – Малъ Скрылевъ Jul 14 '22 at 07:35

Psych::DisallowedClass while updating a rails ActiveModel entry

2 Answers2