Stop json/plain from allocating arbitrary classes (0.0.7)

.github/workflows/tests.yml

@@ -2,9 +2,10 @@ name: Tests
 
 on:
   push:
-    branches: [ "master" ]
+    # This fork ships from transfers-master. Without it, PRs to that branch had no CI.
+    branches: [ "master", "transfers-master" ]
   pull_request:
-    branches: [ "master" ]
+    branches: [ "master", "transfers-master" ]
 
 jobs:
   test_gem:
@@ -35,9 +36,10 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
+      # ubuntu-latest no longer ships the docker-compose v1 binary.
       - name: Start dependencies
         run: |
-          docker-compose \
+          docker compose \
             -f examples/docker-compose.yml \
             up -d
 
@@ -50,13 +52,31 @@ jobs:
         run: |
           cd examples && bundle install --path vendor/bundle
 
-      - name: Wait for dependencies to settle
+      # auto-setup is not ready after a fixed sleep; wait until gRPC accepts connections.
+      - name: Wait for Temporal
         run: |
-          sleep 10
-
+          if timeout 300 bash -c 'until echo >/dev/tcp/127.0.0.1/7233; do sleep 2; done'; then
+            exit 0
+          fi
+          echo "Temporal did not listen on 7233"
+          docker compose -f examples/docker-compose.yml ps -a
+          docker compose -f examples/docker-compose.yml logs --no-color --tail 400
+          exit 1
+
+      # register_namespace can still race the server after 7233 is open.
       - name: Register namespace
         run: |
-          cd examples && bin/register_namespace ruby-samples
+          cd examples
+          for i in $(seq 1 30); do
+            if bin/register_namespace ruby-samples; then
+              exit 0
+            fi
+            echo "register_namespace failed, retry ${i}"
+            sleep 5
+          done
+          docker compose -f docker-compose.yml ps
+          docker compose -f docker-compose.yml logs --tail 200
+          exit 1
 
       - name: Wait for namespace to settle
         run: |
@@ -78,6 +98,11 @@ jobs:
         run: |
           cd examples && bin/worker &
 
+      # Workers are started in the background; they are not ready at process spawn.
+      - name: Wait for workers
+        run: |
+          sleep 10
+
       - name: Run RSpec
         env:
           USE_ERROR_SERIALIZATION_V2: 1

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.0.7
+
+- `json/plain` no longer builds arbitrary Ruby classes from encoded payloads. That was possible because Oj object mode can allocate any constant named in the payload.
+- Still round-trips first-party shapes: activity `Request` / `Response`, `Temporal::` types, Exception subclasses (including backtraces), `Date` / `DateTime` / `Rational`, anonymous Structs, and classes registered with `Temporal::JSON.allow_class` (including Oj `^O` dumps).
+- Rejects duplicate JSON object keys. Oj and `JSON.parse` disagree on duplicates, so a discarded value could still allocate a class.
+- Rejects constants that are only pending `autoload` until they are actually loaded.
+- Rejects JSON nested deeper than 512 levels.
+- Encoding name stays `json/plain`.
+- Runtime depends on `google-protobuf` ~> 3.25 (generated stubs under `lib/gen/` require protobuf 3).
+
 ## 0.0.6
 
 - Defer gRPC loading via autoload for fork safety

examples/docker-compose.yml

@@ -1,8 +1,9 @@
 version: '3.5'
 
+# Pin images. auto-setup:latest never bound gRPC :7233 with Cassandra 3.11 on GitHub runners.
 services:
   temporal:
-    image: temporalio/auto-setup:latest
+    image: temporalio/auto-setup:1.22.4
     ports:
      - "7233:7233"
     environment:
@@ -14,7 +15,7 @@ services:
       - cassandra
 
   temporal-web:
-    image: temporalio/web:latest
+    image: temporalio/web:1.15.0
     environment:
       - "TEMPORAL_GRPC_ENDPOINT=temporal:7233"
     ports:
@@ -23,6 +24,6 @@ services:
       - temporal
 
   cassandra:
-    image: cassandra:3.11
+    image: cassandra:3.11.16
     ports:
       - "9042:9042"

lib/temporal/concerns/input_deserializer.rb

@@ -3,7 +3,9 @@ module Concerns
     module InputDeserializer
       def deserialize(input)
         JSON.deserialize(input)
-      rescue Oj::ParseError
+      rescue Oj::ParseError, ::JSON::ParserError
+        # JSON.parse now runs before Oj.load, so newline-split Go-client input raises
+        # JSON::ParserError instead of Oj::ParseError. Do not rescue JSONDisallowedClassError.
         # Copied over from the Cadence side, similar situation happening with Temporal
         #
         # cadence official go-client serializes / deserializes input in a different format than this ruby client

lib/temporal/errors.rb

@@ -2,6 +2,9 @@ module Temporal
   # Superclass for all Temporal errors
   class Error < StandardError; end
 
+  # Raised when json/plain asks Oj to allocate a class that is not allowlisted.
+  class JSONDisallowedClassError < Error; end
+
   # Superclass for errors specific to Temporal worker itself
   class InternalError < Error; end