Re:What The Rails Security Issue Means For Your Startup
by makomk on Friday February 01, 2013 @05:50AM
(#5150140)
You're describing the previous Ruby on Rails vulnerability. The latest one involved them deliberately using the YAML parser to parse untrusted JSON data. Also, the RubyGems compromise was a result of them parsing gem metadata represented using YAML - since the metadata is YAML you pretty much have to use a YAML parser to parse it.
[ Parent
| on HN ]
Re:What The Rails Security Issue Means For Your Startup
by mnarayan01 on Friday February 01, 2013 @10:05AM
(#5151066)
Using YAML to parse JSON was obviously non-optimal, which is (presumably) why Rails stopped doing it in 3.1 (thus the vulnerability your refer to is only present in 3.0 and 2.x).
W.r.t RubyGems, I hear what you're saying, but that doesn't mean there's a bug in psych. Even the feature request of adding a safe_load option strikes me as problematic...either you're limiting the markup to json with comments, or you'd have to name the option something like sort_of_safe_load.