Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by jmillikin on Monday January 28, 2013 @04:29PM
(#5130770)
The Rails YAML parser allows execution of arbitrary Ruby code, by design. If an attacker can figure out how to get input into the YAML parser, they win.
[ Parent
| on HN ]
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by tveita on Monday January 28, 2013 @04:55PM
(#5130922)
That's awful.
This seems to be something of a theme with RoR. XML parsers that parse YAML, JSON parsers that parse YAML, YAML parsers that parse Ruby...
Why would they let that mess near user input? I thought Ruby included a proper JSON parser now.
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by knowtheory on Monday January 28, 2013 @05:01PM
(#5130952)
It does now. But it didn't in versions <3.1.
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by postmodern_mod3 on Monday January 28, 2013 @07:48PM
(#5131704)
YAML does not allow execution of arbitrary Ruby code. Some YAML types allow specifying a custom class, which the Psych YAML parser (default in Ruby 1.9) will call the initialize or []= methods. If you can find a class that eventually evals() input passed to initialize or []=, then you win.
http://ronin-ruby.github.com/blog/2013/01/09/rails-pocs.html