News for hackers. Stuff that matters.

A comment on Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3. Parent comment

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by tveita on Monday January 28, 2013 @04:55PM (#5130922)
That's awful.

This seems to be something of a theme with RoR. XML parsers that parse YAML, JSON parsers that parse YAML, YAML parsers that parse Ruby...

Why would they let that mess near user input? I thought Ruby included a proper JSON parser now.

[ Parent | on HN ]
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by knowtheory on Monday January 28, 2013 @05:01PM (#5130952)
It does now. But it didn't in versions <3.1.
[ Parent | on HN ]