From ba8cb591f045deb81ce8cc9d64ca104a80bc7517 Mon Sep 17 00:00:00 2001
From: lenamonj <jlenamon@gmail.com>
Date: Thu, 3 Sep 2026 15:42:53 -0400
Subject: [PATCH] Parse imported JSON rates with JSON.parse

---
 AUTHORS                                   |  5 +++--
 CHANGELOG.md                              |  2 ++
 lib/money/bank/variable_exchange.rb       |  2 +-
 spec/money/bank/variable_exchange_spec.rb | 13 +++++++++++++
 4 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/AUTHORS b/AUTHORS
index b148422ff6..2d9b131352 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -64,7 +64,6 @@ James Hunt
 Jean-Louis Giordano
 Jean-Philippe Doyle
 Jell
-Jérémy Lecour
 Jeremy McNevin
 Jesse Cooke
 Jim Kingdon
@@ -78,13 +77,14 @@ Joshua Clayton
 Julia Aalbers
 Julia López
 Julien Boyer
+Jérémy Lecour
 Kaleem Ullah
 Kenichi Kamiya
 Kenn Ejima
 Kenneth Salomon
 kirillian
 Laurynas Butkus
-Łukasz Wójcik
+lenamonj
 Marcel Scherf
 Marco Otte-Witte
 Mateus Gomes
@@ -152,4 +152,5 @@ Yok
 Yuri Sidorov
 Yuusuke Takizawa
 Zubin Henner
+Łukasz Wójcik
 Бродяной Александр
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b3ad4e6535..074e591272 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Fix `Money::Bank::VariableExchange#import_rates` parsing `:json` with `JSON.load`, which instantiates any class named by a `json_class` key; it now uses `JSON.parse`
+
 ## 7.1.1
 
 - Fix `sig/manifest.yaml` declaring `set` as a dependency, which made `rbs -r money` and Steep's `library "money"` fail with `UnknownLibraryError` on every RBS >= 3.0.0
diff --git a/lib/money/bank/variable_exchange.rb b/lib/money/bank/variable_exchange.rb
index bd269a6a3f..f2aaa4f1f0 100644
--- a/lib/money/bank/variable_exchange.rb
+++ b/lib/money/bank/variable_exchange.rb
@@ -267,7 +267,7 @@ def import_rates(format, string, _opts = {})
         end
 
         store.transaction do
-          data = FORMAT_SERIALIZERS[format].load(string)
+          data = format == :json ? JSON.parse(string) : FORMAT_SERIALIZERS[format].load(string)
 
           data.each do |key, rate|
             from, to = key.split(SERIALIZER_SEPARATOR)
diff --git a/spec/money/bank/variable_exchange_spec.rb b/spec/money/bank/variable_exchange_spec.rb
index f1fdc99680..ab46fe0c4e 100644
--- a/spec/money/bank/variable_exchange_spec.rb
+++ b/spec/money/bank/variable_exchange_spec.rb
@@ -225,6 +225,19 @@
         expect(bank.get_rate("USD", "EUR")).to eq 1.25
         expect(bank.get_rate("USD", "JPY")).to eq 2.55
       end
+
+      it "does not instantiate objects named by a json_class key" do
+        gadget = Class.new do
+          def self.json_create(_object)
+            raise "json_create must never be called while importing rates"
+          end
+        end
+        stub_const("JsonGadget", gadget)
+
+        bank.import_rates(:json, '{"USD_TO_EUR":{"json_class":"JsonGadget"}}')
+
+        expect(bank.get_rate("USD", "EUR")).to eq({ "json_class" => "JsonGadget" })
+      end
     end
 
     context "with format == :ruby" do