News for hackers. Stuff that matters.

A comment on What The Rails Security Issue Means For Your Startup.

Re:What The Rails Security Issue Means For Your Startup by s1kx on Thursday January 31, 2013 @12:18PM (#5146013)
Is there no hardened version of Psych which lets you either disable object deserialization, or whitelist classes? That would seem like the safest option right now to guard against coming vulnerabilities in Rails in this regard.
[ Parent | on HN ]
Re:What The Rails Security Issue Means For Your Startup by trapexit on Thursday January 31, 2013 @02:29PM (#5146829)
This is currently being discussed on https://github.com/tenderlove/psych/issues/119

There is also https://github.com/dtao/safe_yaml (hat tip @patio11, who also points out that this has not been audited for completeness/correctness)

[ Parent | on HN ]