Merge pull request #12201 from chancancode/json_load

Replace JSON.load with JSON.parse

2 files changed, 16 insertions, 3 deletions

diff --git a/activesupport/lib/active_support/json/decoding.rb b/activesupport/lib/active_support/json/decoding.rb
index 30833a4cb1..2533ff43e1 100644
--- a/activesupport/lib/active_support/json/decoding.rb
+++ b/activesupport/lib/active_support/json/decoding.rb
@@ -13,8 +13,8 @@ module ActiveSupport
       #
       #   ActiveSupport::JSON.decode("{\"team\":\"rails\",\"players\":\"36\"}")
       #   => {"team" => "rails", "players" => "36"}
-      def decode(json, proc = nil, options = {})
-        data = ::JSON.load(json, proc, options)
+      def decode(json, options = {})
+        data = ::JSON.parse(json, options.merge(create_additions: false))
         if ActiveSupport.parse_json_times
           convert_dates_from(data)
         else
diff --git a/activesupport/test/json/decoding_test.rb b/activesupport/test/json/decoding_test.rb
index 99c5f2d1ec..3ec9b06d6a 100644
--- a/activesupport/test/json/decoding_test.rb
+++ b/activesupport/test/json/decoding_test.rb
@@ -4,6 +4,12 @@ require 'active_support/json'
 require 'active_support/time'
 
 class TestJSONDecoding < ActiveSupport::TestCase
+  class Foo
+    def self.json_create(object)
+      "Foo"
+    end
+  end
+
   TESTS = {
     %q({"returnTo":{"\/categories":"\/"}})        => {"returnTo" => {"/categories" => "/"}},
     %q({"return\\"To\\":":{"\/categories":"\/"}}) => {"return\"To\":" => {"/categories" => "/"}},
@@ -52,7 +58,8 @@ class TestJSONDecoding < ActiveSupport::TestCase
     # tests escaping of "\n" char with Yaml backend
     %q({"a":"\n"})  => {"a"=>"\n"},
     %q({"a":"\u000a"}) => {"a"=>"\n"},
-    %q({"a":"Line1\u000aLine2"}) => {"a"=>"Line1\nLine2"}
+    %q({"a":"Line1\u000aLine2"}) => {"a"=>"Line1\nLine2"},
+    %q({"json_class":"TestJSONDecoding::Foo"}) => {"json_class"=>"TestJSONDecoding::Foo"}
   }
 
   TESTS.each_with_index do |(json, expected), index|
@@ -78,5 +85,11 @@ class TestJSONDecoding < ActiveSupport::TestCase
   def test_failed_json_decoding
     assert_raise(ActiveSupport::JSON.parse_error) { ActiveSupport::JSON.decode(%({: 1})) }
   end
+
+  def test_cannot_force_json_unmarshalling
+    encodeded = %q({"json_class":"TestJSONDecoding::Foo"})
+    decodeded = {"json_class"=>"TestJSONDecoding::Foo"}
+    assert_equal decodeded, ActiveSupport::JSON.decode(encodeded, create_additions: true)
+  end
 end