News for hackers. Stuff that matters.

A comment on Denial of Service and Unsafe Object Creation Vulnerability in JSON Gem. Parent comment

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by benmmurphy on Monday February 11, 2013 @02:53PM (#5202852)
nice find. there is sql injection in 2.3.x and it effects all adapters and not just postgresql.

i just tried quoted_id and it works against mysql on 3.2.x as well. quoted_id is defined in abstract/quoting.rb and any adapter that forwards quotes to the superclass will use it.

[ Parent | on HN ]
Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by Tho85 on Monday February 11, 2013 @05:22PM (#5203739)
You're right! Thanks for the hint, I updated the blog post accordingly.
[ Parent | on HN ]