MultiXml gem has same vulnerability as Rails' CVE-2013-0156

Re:MultiXml gem has same vulnerability as Rails' CVE-2013-01... by sferik on Friday January 11, 2013 @02:31AM (#5041788)

That's correct. But I'm planning to remove this functionality anyway, just to be safe. It's too easy to accidentally open this vulnerability and it's unclear what the valid use-case is for parsing YAML or symbols from XML.

When I implemented this functionality, it was only to be compatible with the Rails parser.

[ Parent | on HN ]

There are no comments on this comment yet.