Any way to pass in allowed classes so the YAML.load deserialize things saved before the Active Record update?

[gpinkham]

Any way to pass in allowed classes so the YAML.load deserialize things saved before the Active Record update?

[ledermann]

I have added this to application.rb of my app and it works fine:

config.active_record.yaml_column_permitted_classes = [
  Symbol,
  Date,
  Time,
  # + some custom classes
]

[gpinkham]

forgot to past the CVE. https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017

[gpinkham]

Thanks for the info!