Settingslogic - MITRE Fork

A simple and straightforward settings solution that uses an ERB enabled YAML file and a singleton design pattern. This is a MITRE-maintained fork with Ruby 3.x and Rails 7.x+ compatibility.

The original settingslogic gem hasn't been updated since 2012 but is still widely used. This fork provides:

• ✅ Ruby 3.x compatibility - Full support for Ruby 3.0, 3.1, 3.2, 3.3, and 3.4
• ✅ Psych 4 support - Handles YAML aliases correctly with Ruby 3.1+
• ✅ Rails 7.x/8.x compatibility - Works with modern Rails versions
• ✅ Security updates - Modern security practices and dependency updates
• ✅ Maintained - Active maintenance and support

Add this to your Gemfile:

# Use the MITRE fork for Ruby 3.x compatibility
gem 'settingslogic', github: 'mitre/settingslogic', branch: 'main'

Or if we publish to RubyGems:

gem 'mitre-settingslogic'

# app/models/settings.rb (for Rails)
# or anywhere in your Ruby project
class Settings < Settingslogic
  source "#{Rails.root}/config/application.yml"
  namespace Rails.env
end

# config/application.yml
defaults: &defaults
  host: localhost
  port: 3000
  ssl: false
  
development:
  <<: *defaults
  database: myapp_development
  
production:
  <<: *defaults
  host: production.example.com
  port: 443
  ssl: true
  database: myapp_production

Settings.host          # => "localhost" in development, "production.example.com" in production
Settings.port          # => 3000 in development, 443 in production
Settings.ssl?          # => false in development, true in production
Settings.database      # => "myapp_development" in development

# Nested settings
Settings.smtp.address  # => Access nested configuration
Settings['smtp']['address']  # => Hash-style access also works

# Settings with ERB
production:
  secret_key: <%= ENV['SECRET_KEY_BASE'] %>
  redis_url: <%= ENV['REDIS_URL'] || 'redis://localhost:6379' %>

class DatabaseSettings < Settingslogic
  source "#{Rails.root}/config/database_settings.yml"
  namespace Rails.env
end

class FeatureFlags < Settingslogic
  source "#{Rails.root}/config/features.yml"
  namespace Rails.env
end

class Settings < Settingslogic
  source "#{Rails.root}/config/application.yml"
  namespace Rails.env
  suppress_errors true  # Returns nil instead of raising errors for missing keys
end

# Access nested keys with dot notation
Settings.get('database.pool.size')  # => 5
Settings.get('redis.cache.ttl')     # => 3600

The main issue with the original gem is that Ruby 3.1+ ships with Psych 4, which disables YAML aliases by default. This fork handles that correctly:

# This YAML with aliases now works correctly in Ruby 3.1+
defaults: &defaults
  timeout: 30
  retries: 3

production:
  <<: *defaults  # This alias expansion works!
  timeout: 60

• ✅ Fixed deprecated has_key? → key?
• ✅ Added to_ary method for RSpec compatibility
• ✅ Improved symbolize_keys for nested hashes
• ✅ Added stringify_keys for Rails compatibility
• ✅ Better error messages
• ✅ Security improvements for eval usage
• ✅ Frozen string literals
• ✅ Modern Ruby idioms

Tested and working with:

• Ruby: 2.7, 3.0, 3.1, 3.2, 3.3, 3.4
• Rails: 5.2, 6.0, 6.1, 7.0, 7.1, 8.0
• Psych: 3.x and 4.x

• Default behavior: Uses YAML.safe_load to prevent arbitrary code execution
• Permitted classes: Symbol, Date, Time, DateTime, BigDecimal
• Custom classes: Add via Settingslogic.yaml_permitted_classes += [MyClass]
• Migration path: Temporary opt-out with Settingslogic.use_yaml_unsafe_load = true (deprecated, will be removed in v4.0.0)

• URL loading uses Net::HTTP instead of vulnerable open-uri
• All eval usage includes proper __FILE__ and __LINE__ tracking
• No arbitrary code execution vulnerabilities in default configuration

We welcome contributions! Please see CONTRIBUTING.md for details.

This project is licensed under the MIT License - see LICENSE.md for details.

• Original gem created by Ben Johnson (binarylogic)
• Community maintainers at settingslogic/settingslogic
• Key fixes incorporated from:
  • minorun99/settingslogic - Ruby 3.2 compatibility
  • etozzato/settingslogic - Psych 4 safe_load implementation
  • bigcommerce/settingslogic - Various compatibility fixes
  • tvw/settingslogic - Ruby 3 support
  • And many others who kept this gem alive through their forks and PRs
• Special thanks to all who submitted PRs to the original repo, especially PR #86 for Psych 4 compatibility

• Original Documentation
• MITRE Fork Issues
• MITRE Fork Repository

This fork is maintained by MITRE Corporation to support our Ruby applications, particularly Vulcan and other security tools.

Maintained with ❤️ by the MITRE Security Automation Framework Team