3 ms·
Yaml.rb patch to block the rails exploit and most similar classes of exploits
- cdcarter 14y agoCorrect me if I am wrong, but this solves the YAML half of the exploit but not the XML part, right? This is not a complete patch against the exploits?
- dandandan 14y agoNot all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.