Is deserialize_symbols still a valid safety concern?

[jules2689]

Hey all,

I have a question about the deserialize_symbols safety concern.

since symbols are not garbage collected in Ruby and so deserializing them from YAML may render your application vulnerable to a DOS (denial of service) attack. To allow symbol deserialization by default:

It seems that Ruby 2.2+ is able to GC symbols, so is SafeYAML::OPTIONS[:deserialize_symbols] to false valid anymore?

Rails is starting to use the symbolize_names feature, which is not supported on SafeYAML, and things are silently breaking.

If we no longer need this safety mechanism, should it be removed?