lib/anyway/loaders/yaml.rb in anyway_config-2.6.2 vs lib/anyway/loaders/yaml.rb in anyway_config-2.6.3

@@ -7,10 +7,16 @@
 using Anyway::Ext::Hash
 
 module Anyway
   module Loaders
     class YAML < Base
+      @@permitted_classes = []
+
+      class << self
+        def permitted_classes = @@permitted_classes
+      end
+
       def call(config_path:, **_options)
         rel_config_path = relative_config_path(config_path).to_s
         base_config = trace!(:yml, path: rel_config_path) do
           config = load_base_yml(config_path)
           environmental?(config) ? config_with_env(config) : config
@@ -51,12 +57,12 @@
         # By default, YAML load will return `false` when the yaml document is
         # empty. When this occurs, we return an empty hash instead, to match
         # the interface when no config file is present.
         begin
           if defined?(ERB)
-            ::YAML.load(ERB.new(File.read(path)).result, aliases: true) || {}
+            ::YAML.load(ERB.new(File.read(path)).result, aliases: true, permitted_classes: self.class.permitted_classes) || {}
           else
-            ::YAML.load_file(path, aliases: true) || {}
+            ::YAML.load_file(path, aliases: true, permitted_classes: self.class.permitted_classes) || {}
           end
         rescue ArgumentError
           if defined?(ERB)
             ::YAML.load(ERB.new(File.read(path)).result) || {}
           else