# Rails 2.3 SafeBuffer leaked evil all over my yaml

**URL:** <https://www.ruby-forum.com/t/rails-2-3-safebuffer-leaked-evil-all-over-my-yaml/186219>\
**Category:** Rails\
**Created:** [April 2, 2010, 11:35am UTC](https://www.ruby-forum.com/t/rails-2-3-safebuffer-leaked-evil-all-over-my-yaml/186219 "2010-04-02T11:35:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![skwp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/5fc32e/32.png) [@skwp](https://www.ruby-forum.com/u/skwp)\
**Post date:** [April 2, 2010, 11:35am UTC](https://www.ruby-forum.com/t/rails-2-3-safebuffer-leaked-evil-all-over-my-yaml/186219/1 "2010-04-02T11:35:40Z")

</div>

I’ve been googling for a while to find a solution to this, but can’t  
seem to.

What’s happening is that after upgrading from rails 2.1 to rails 2.3,  
my YAML started getting, for lack of a better word, ‘evil’ due to the  
introduction of the SafeBuffer class.

I thought SafeBuffer was related to ERB implementation only but it  
seems to have affected the output generated by .to\_yaml, causing  
clients that want to parse this yaml to choke (not knowing anything  
about SafeBuffers). Grepping rails source for SafeBuffer I see nothing  
that could affect the yaml class…so it seems the safebuffer

This is what an evil-ized safebuffered yaml looks like (just a piece  
of it)

BAD/EVIL:

somevalue: !str  
str: “yes”  
“@\_rails\_html\_safe”: false

GOOD (before safebuffers)

somevalue: yes

Any ideas greatly appreciated!  
Yan