Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by mikeash on Monday January 28, 2013 @08:00PM
(#5131749)
My understanding is that YAML is supposed to be highly general-purpose and is not supposed to be resilient to malicious input. These aren't YAML parser bugs, these are framework bugs that pass malicious data to the YAML parser when that parser should never be exposed to it. And that in turn appears to be entirely due to an extremely overly-helpful and magical nature of the framework.
[ Parent
| on HN ]
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by koide on Monday January 28, 2013 @10:42PM
(#5132198)
Nope, the problem is not due to the magical nature of the framework.
They implemented the JSON decoder with a JSON to YAML converter, passing that through the YAML decoder.
The fix involves using an actual JSON parser and skip the going through YAML part. So it does qualify as a JSON parser bug, IMO (which is what I clumsily attempted to imply with my "(or JSON)" clause above.)