Denial of Service and Unsafe Object Creation Vulnerability in JSON Gem

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by Tho85 on Monday February 11, 2013 @01:45PM (#5202443)

Some details on how this can be exploited:

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-ma...

[ Parent | on HN ]

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by tenderlove on Monday February 11, 2013 @02:09PM (#5202613)

Thanks for reporting this issue to us! :-D

<3<3<3<3

[ Parent | on HN ]

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by Tho85 on Monday February 11, 2013 @05:10PM (#5203659)

Was a pleasure!

With love :-) Thomas

[ Parent | on HN ]

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by benmmurphy on Monday February 11, 2013 @02:53PM (#5202852)

nice find. there is sql injection in 2.3.x and it effects all adapters and not just postgresql.

i just tried quoted_id and it works against mysql on 3.2.x as well. quoted_id is defined in abstract/quoting.rb and any adapter that forwards quotes to the superclass will use it.

[ Parent | on HN ]

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by Tho85 on Monday February 11, 2013 @05:22PM (#5203739)

You're right! Thanks for the hint, I updated the blog post accordingly.

[ Parent | on HN ]