From ef346a29b134e745218fe5c9e27a8697d53ec8f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Tue, 31 Mar 2020 17:36:55 +0200
Subject: [PATCH] Enable loading objects from YAML documents
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

YAML-LibYAML-0.81 disabled $YAML::XS::LoadBlessed by default and that
broke STD that relies on deserializing AST objects from YAML
documents.

This patch reenables it. STD library seems to load only its own
documents so it does not possess a security issue. The viv tools is
somewhat questionable.

CPAN RT#132275

Signed-off-by: Petr Písař <ppisar@redhat.com>
---
 bin/viv       | 1 +
 lib/STD.pm    | 1 +
 lib/STD_P5.pm | 1 +
 3 files changed, 3 insertions(+)

diff --git a/bin/viv b/bin/viv
index d13fb67..8dd8717 100644
--- a/bin/viv
+++ b/bin/viv
@@ -44,6 +44,7 @@ use YAML::XS; # An attempt to replace this with YAML::Syck passed the
               # disjoint sets of descending numbers.  Also, empty
               # sequences shown as [] became followed by an empty line.
               # See also: YAML::Syck in package VAST::package_def below.
+$YAML::XS::LoadBlessed = 1;
 use Encode;
 use Scalar::Util 'blessed', 'refaddr';
 use Storable;
diff --git a/lib/STD.pm b/lib/STD.pm
index 1ae16c2..00b503e 100644
--- a/lib/STD.pm
+++ b/lib/STD.pm
@@ -27,6 +27,7 @@ my $retree;
 $DB::deep = $DB::deep = 1000; # suppress used-once warning
 
 use YAML::XS;
+$YAML::XS::LoadBlessed = 1;
 
 $SIG{__WARN__} = sub { die @_,"   statement started at line ", 'STD::Cursor'->lineof($::LASTSTATE), "
 " } if $::DEBUG;
diff --git a/lib/STD_P5.pm b/lib/STD_P5.pm
index 8828e5f..654bbfa 100644
--- a/lib/STD_P5.pm
+++ b/lib/STD_P5.pm
@@ -43,6 +43,7 @@ my $retree;
 $DB::deep = $DB::deep = 1000; # suppress used-once warning
 
 use YAML::XS;
+$YAML::XS::LoadBlessed = 1;
 
 $SIG{__WARN__} = sub { die @_,"   statement started at line ", 'STD::Cursor'->lineof($::LASTSTATE), "
 " } if $::DEBUG;
-- 
2.21.1