Summary
Audit usage of JSON.load (prefer JSON.parse).
Approach
Run:
rg -n "\\bJSON\\.load\\b" --glob "*.rb"
For each call site:
- Replace with
JSON.parse unless there's a strong, documented need for JSON.load
- Ensure any parsing of external/user data uses safe defaults
Acceptance Criteria
Verification Plan
- Patch call sites
- Run:
bundle exec rake test (affected engine(s) or default)
Summary
Audit usage of
JSON.load(preferJSON.parse).Approach
Run:
For each call site:
JSON.parseunless there's a strong, documented need forJSON.loadAcceptance Criteria
JSON.loadon untrusted inputsVerification Plan
bundle exec rake test(affected engine(s) or default)