Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by koide on Monday January 28, 2013 @10:42PM
(#5132198)
Nope, the problem is not due to the magical nature of the framework.
They implemented the JSON decoder with a JSON to YAML converter, passing that through the YAML decoder.
The fix involves using an actual JSON parser and skip the going through YAML part. So it does qualify as a JSON parser bug, IMO (which is what I clumsily attempted to imply with my "(or JSON)" clause above.)
They implemented the JSON decoder with a JSON to YAML converter, passing that through the YAML decoder.
The fix involves using an actual JSON parser and skip the going through YAML part. So it does qualify as a JSON parser bug, IMO (which is what I clumsily attempted to imply with my "(or JSON)" clause above.)