pentestercrab · 25 points · 4 comments · il y a 3 heures · Open original
Comments
2 preview comments · loading full thread
Log in to use comments
Log in to h4cker, then connect Hacker News to publish comments.
NENextgridil y a 1 heure
Doesn't this already require to be "on the other side of the airtight hatchway", or am I missing something?
The Marshal.load docs explicitly have a warning that you should not pass it untrusted data: https://docs.ruby-lang.org/en/master/Marshal.html#module-mar...
SEsebiwil y a 1 heure
Which brings us to the old saying: Do not deserialize untrusted data.
In the context of Rubygems and their specs this obviously is harder to manage but dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base.
Comments
2 preview comments · loading full threadLog in to h4cker, then connect Hacker News to publish comments.
Doesn't this already require to be "on the other side of the airtight hatchway", or am I missing something? The Marshal.load docs explicitly have a warning that you should not pass it untrusted data: https://docs.ruby-lang.org/en/master/Marshal.html#module-mar...
Which brings us to the old saying: Do not deserialize untrusted data. In the context of Rubygems and their specs this obviously is harder to manage but dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base.