News for hackers. Stuff that matters.

A comment on Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3. Parent comment

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by postmodern_mod3 on Monday January 28, 2013 @11:37PM (#5132351)
Not unless nginx/apache routes the request directly to public/. There will definitely be more code-paths to YAML.load, but so far ActionDispatch::Http::Parameters has been the entry point.
[ Parent | on HN ]

There are no comments on this comment yet.