3 ms·
> There are lots of good use cases for deserializing untrusted data Yes, and untrusted user data should not have arrived at the system in pickle format. And in
by nurettin 6y ago
> There are lots of good use cases for deserializing untrusted data
Yes, and untrusted user data should not have arrived at the system in pickle format. And in case of RoR, it should not have arrived in YAML format or loaded with YAML.load[1] So my point stands.
[1] https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3284f https://gist.github.com/niklasb/df9dba3097df536820888aeb4de3...