the other thing to note is that if your application is deserializing untrusted input using Marshall.load and calling methods on the deserialized objects then th

the other thing to note is that if your application is deserializing untrusted input using Marshall.load and calling methods on the deserialized objects then there is a chance that you are vulnerable to arbitrary ruby code execution. in that case an attacker could execute whatever sql he wanted to anyway.