4 ms·
https://github.com/ruby/psych https://github.com/ruby/psych defaults to only loading permitted classes since 4.0 so that seems less of a concern now?
by Rafert 4y ago
https://github.com/ruby/psych https://github.com/ruby/psych defaults to only loading permitted classes since 4.0 so that seems less of a concern now?
- jrochkind1 4y ago`psych`, used for YAML, is a different thing than Marshal. pstore uses Marshal. https://ruby-doc.org/core-2.6.3/Marshal.html https://ruby-doc.org/core-2.6.3/Marshal.html. I don't believe psych will be involved with pstore. I'm honestly not sure, though, how much I should be worried about the fact that someone who has write access to my database can maybe escalate that to an arbitrary code execution if I use pstore. Literally not sure. Write access to my DB seems pretty disastrous already...