CVE-2025-68271

@@ -22,6 +22,7 @@
 
 require 'openc3/packets/binary_accessor'
 require 'openc3/ext/string' if RUBY_ENGINE == 'ruby' and !ENV['OPENC3_NO_EXT']
+require 'yaml'
 
 # OpenC3 specific additions to the Ruby String class
 class String
@@ -40,6 +41,8 @@ class String
   HEX_CHECK_REGEX = /\A\s*0[xX][\dabcdefABCDEF]+\s*\z/
   # Regular expression to identify a String as an Array of numbers
   ARRAY_CHECK_REGEX = /\A\s*\[.*\]\s*\z/
+  # Regular expression to identify a String containing object notation
+  OBJECT_CHECK_REGEX = /\A\s*\{.*\}\s*\z/
 
   # Displays a String containing binary data in a human readable format by
   # converting each byte to the hex representation.
@@ -209,6 +212,11 @@ def is_array?
     if ARRAY_CHECK_REGEX.match?(self) then true else false end
   end
 
+  # @return [Boolean] Whether the String represents an Object
+  def is_object?
+    if OBJECT_CHECK_REGEX.match?(self) then true else false end
+  end
+
   # @return [Boolean] Whether the string contains only printable characters
   def is_printable?
     if NON_PRINTABLE_REGEX.match?(self) then false else true end
@@ -238,9 +246,9 @@ def convert_to_value
       elsif self.is_hex?
         # Hex
         return_value = Integer(self)
-      elsif self.is_array?
-        # Array
-        return_value = eval(self)
+      elsif self.is_array? or self.is_object?
+        # Array or Object
+        return_value = YAML.safe_load(self)
       end
     rescue Exception
       # Something went wrong so just return the string as is

@@ -39,6 +39,8 @@
 # Regular expression to identify a String as an Array of numbers
 ARRAY_CHECK_REGEX = re.compile(r"\A\s*\[.*\]\s*\Z")
 
+# Regular expression to identify a String as an Object
+OBJECT_CHECK_REGEX = re.compile(r"\A\s*\{.*\}\s*\Z")
 
 # Pulls all string keyword arguments into the args array.
 def extract_string_kwargs_to_args(args: list, kwargs: dict):
@@ -83,6 +85,13 @@ def is_array(string):
     return False
 
 
+def is_object(string):
+    """Whether the String represents an Object"""
+    if OBJECT_CHECK_REGEX.match(string):
+        return True
+    return False
+
+
 def convert_to_value(string):
     """Converts the String into either a Float, Integer, or Array
     depending on what the String represents. It can successfully convert
@@ -101,8 +110,8 @@ def convert_to_value(string):
         elif is_hex(string):
             # Hex
             return_value = int(string, 0)
-        elif is_array(string):
-            # Array
+        elif is_array(string) or is_object(string):
+            # Array or Object
             return_value = ast.literal_eval(string)
     except Exception:
         # Something went wrong so just return the string as is

@@ -206,8 +206,12 @@
       expect("[0,1,2,3]".convert_to_value).to eql [0, 1, 2, 3]
     end
 
-    it "just returns the string if something goes wrong" do
-      expect("[.a,2,3]".convert_to_value).to eql "[.a,2,3]"
+    it "is very tolerant to array contents" do
+      expect("[.a,2,3]".convert_to_value).to eql [".a",2,3]
+    end
+
+    it "it handles objects" do
+      expect("{'hello':'goodbye'}".convert_to_value).to eql({"hello" => "goodbye"})
     end
 
     it "doesn't match(multiline strings" do