Denial of Service and Unsafe Object Creation Vulnerability in JSON Gem

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by benmmurphy on Monday February 11, 2013 @04:00PM (#5203184)

there are methods in the ruby reflection api that take strings and silently convert them to symbols so it is really easy to accidentally leak memory.

however, on ruby trunk they added a method: rb_check_id which can be used to check if a string has been already symbolized (https://github.com/ruby/ruby/blob/trunk/parse.y#L10465). this means when these reflection methods get passed a string and it hasn't been symbolized they can bail out and not symbolize the string. (https://github.com/ruby/ruby/blob/trunk/object.c#L2073)

[ Parent | on HN ]

Re:Denial of Service and Unsafe Object Creation Vulnerabilit... by oinksoft on Monday February 11, 2013 @04:04PM (#5203212)

This is an excellent development.

Indeed, when researching just now, I saw examples of people throwing strings at Module#const_defined?, which no doubt get converted to symbols straightaway.

[ Parent | on HN ]