Allow options on Mash.load (#474)

`Mash.load` uses the Ruby standard library to load Yaml-serialized files
into a Mash. The original implementation used `YAML.load` for this
purpose. However, that method is inherently unsafe so we switched to
using `YAML.safe_load`.

Safely loading Yaml files has many different domain-specific
configuration flags that we did not, by default, expose. This change
introduces the ability to configure the safe loading of Yaml files so
that all types of Yaml can be loaded when necessary using the flags from
the standard library.

This implementation preserves the backwards-compatibility with the prior
implementation so that it should not require updates from users of the
current `Mash.load` behavior. For those who this change affects, we
included upgrading documentation to ease the transition.

3 files changed, 10 insertions, 6 deletions

diff --git a/lib/hashie/extensions/parsers/yaml_erb_parser.rb b/lib/hashie/extensions/parsers/yaml_erb_parser.rb
index d3b5c80..05edc40 100644
--- a/lib/hashie/extensions/parsers/yaml_erb_parser.rb
+++ b/lib/hashie/extensions/parsers/yaml_erb_parser.rb
@@ -6,19 +6,23 @@ module Hashie
   module Extensions
     module Parsers
       class YamlErbParser
-        def initialize(file_path)
+        def initialize(file_path, options = {})
           @content = File.read(file_path)
           @file_path = file_path.is_a?(Pathname) ? file_path.to_s : file_path
+          @options = options
         end
 
         def perform
           template = ERB.new(@content)
           template.filename = @file_path
-          YAML.safe_load template.result, [], [], true
+          whitelist_classes = @options.fetch(:whitelist_classes) { [] }
+          whitelist_symbols = @options.fetch(:whitelist_symbols) { [] }
+          aliases = @options.fetch(:aliases) { true }
+          YAML.safe_load template.result, whitelist_classes, whitelist_symbols, aliases
         end
 
-        def self.perform(file_path)
-          new(file_path).perform
+        def self.perform(file_path, options = {})
+          new(file_path, options).perform
         end
       end
     end
diff --git a/lib/hashie/mash.rb b/lib/hashie/mash.rb
index f41d745..650a269 100644
--- a/lib/hashie/mash.rb
+++ b/lib/hashie/mash.rb
@@ -107,7 +107,7 @@ module Hashie
       raise ArgumentError, "The following file doesn't exist: #{path}" unless File.file?(path)
 
       parser = options.fetch(:parser) { Hashie::Extensions::Parsers::YamlErbParser }
-      @_mashes[path] = new(parser.perform(path)).freeze
+      @_mashes[path] = new(parser.perform(path, options.except(:parser))).freeze
     end
 
     def to_module(mash_method_name = :settings)
diff --git a/lib/hashie/version.rb b/lib/hashie/version.rb
index 1206e92..22480fb 100644
--- a/lib/hashie/version.rb
+++ b/lib/hashie/version.rb
@@ -1,3 +1,3 @@
 module Hashie
-  VERSION = '3.6.1'.freeze
+  VERSION = '3.7.0'.freeze
 end