I've been going through the code for ActiveRecord and now AuthLogic. I'm admittedly not well versed in Ruby. However from the description of the vulnerability

I've been going through the code for ActiveRecord and now AuthLogic. I'm admittedly not well versed in Ruby. However from the description of the vulnerability found at [1], it would appear as though the cookie value can be set to a Ruby string value that is then parsed by server to produce a Ruby Hash value (rather than the AuthLogic plugin's assumed string value). Is the eval() of the cookie value done by Rails or is it done by AuthLogic? Is that a potential security vulnerability in itself? [1]http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html http://phenoelit.org/blog/archives/2012/12/21/let_me_github_... edit: forgot the URL edit2: nvm ... apparently it's using the Ruby Marshal API, not an eval()-type call. http://stackoverflow.com/a/2241740 http://stackoverflow.com/a/2241740