Issue serializing TagList to YAML

[moliver-hemasystems]

I'm in the process of upgrading an application to Rails 7.1.5, and am running

• acts-as-taggable-on (12.0.0)
• audited (5.8.0)
• psych (5.2.0)

The audited gem is used to save a change history for models, which we're currently doing by serializing the data into YAML.

Given a model named Foo, that has a default tag list and is audited:

class Foo < ApplicationRecord
  acts_as_taggable_on :tags
  audited
end

If I try to save a change to the model that includes the tags, I get an exception:

Psych::DisallowedClass:
       Tried to dump unspecified class: Class

I did some digging, and I found that the issue is that Psych is starting to also validate the YAML on-dump and not just on-load. As part of this, it sees that ActsAsTaggableOn::TagList is a subclass of Array and it tries to approve all the items in the array, as well as all the internal variables on the object. When it does this, it finds :@parser is a reference to a class, and then throws the above exception.

I'm assuming that allowing Class would just allow any object, which doesn't seem desirable, so I'm looking at trying to get the tag list to either bypass this or somehow exclude :@parser when it runs through the dump process. I noticed that earlier in the process, it checks if the object has an encode_with method, so I tried adding that to the class in an initializer (for now to get things going):

# config/initializers/acts_as_taggable_on.rb
module ActsAsTaggableOn
  class TagList
    def encode_with(coder)
      coder.represent_seq(nil, self)
    end
  end
end

This seems to work. However, I'm a little fuzzy on serialization and the encode_with functionality, so I wanted to run it by you guys to see if this seems like an appropriate change to make to the class. If it is, I can make a PR with the change. If it isn't, I wanted to at least notify you about the issue.

[crismali]

For a quick workaround, I ended up having audited ignore tag_list

  acts_as_taggable_on :tags
  audited except: :tag_list