7 ms·

Hmm, looking around I am thinking that if you don't want random object instantiation, this monkey-patch: module YAML; @@tagged_classes.delete('tag:ruby.yaml.

• tptacek 14y ago
  It breaks YAML deserialization in other places. You could enable and disable it on demand in the XML parser, but a more sensible solution is just to get YAML the hell out of the XML processor. Trying to make YAML safer is probably not the right approach.
  • mattbee 14y ago
    It's meant to partially break YAML deserialization :) My apps do care about YAML, so I've an interest in cleaning this up. Is there some unintended consequence? You can still instantiate some Ruby classes (Regexp, Symbol etc.) in the YAML loader, or you can go through @@tagged_classes and pick out any other types you don't want. But by taking out Object, YAML is only left with a whitelist of types that are safe, anything else will get turned into a YAML::DomainType.
    • tptacek 14y ago
      What I mean by that is, this workaround breaks application code that depends on other portions of Rails that use XmlMini. In exchange, it allows you to potentially expose YAML to HTTP requests, which is still an extremely bad idea.
      • mattbee 14y ago
        I don't see why YAML is a dangerous serialization format - the other type deserializations in the code seem sane and limited enough. (I wouldn't use YAML over e.g. JSON these days but I'm fixing up quite old projects)
• charliesome 14y ago
  This doesn't stop instantiating with !ruby/object
  • mattbee 14y ago
    How doesn't it? irb(main):001:0> YAML::parse("!ruby/object:File 123").transform => #<File:0x7f2427848e68> irb(main):002:0> module YAML; @@tagged_classes.delete('tag:ruby.yaml.org,2002:object'); end => Object irb(main):003:0> YAML::parse("!ruby/object:File 123").transform => #<YAML::DomainType:0x7f242783a840 @domain="ruby.yaml.org,2002", @type_id="object:File", @value="123"> That's neutered what it'll do without causing the parser to blow up.