3 ms·

> The bug in the YAML parser was reported and the author of the YAML library genuinely couldn't figure out why this mattered or how it could be bad. Is that se

> The bug in the YAML parser was reported and the author of the YAML library genuinely couldn't figure out why this mattered or how it could be bad. Is that seriously what happened? It sounds oddly similar to the Rails issue from about a year ago (the one in which the reporter was able to commit to master on Github), even though I believe that was a separate set of developers altogether. If so, then that might suggest a larger community/cultural issue, which makes me wonder what other exploits exist but haven't been reported (publicly) yet...

purephase 14y ago
Different issue altogether. It was mass-assignment wherein the default Rails config did not have the whitelist enabled by default. The howto is here: http://homakov.blogspot.ca/2012/03/how-to.html http://homakov.blogspot.ca/2012/03/how-to.html
- chimeracoder 14y ago
  I know it was a different vulnerability - I was asking more whether the same developer(s) was/were responsible, since this seems to be a comment pattern that I'm hearing with regards to the initial response to the vulnerabilities.
- tomjen3 14y ago
  Actually it is the same issue as basically all other security issues in web programming (attack on crypto aside): Failure to blacklist non-conforming input. Really, it is that simple and that complicated.
  - dos1 14y ago
    Wouldn't whitelisting conforming input be a better approach? I realize it may be more difficult, but wouldn't that be more secure? Edit: I'm genuinely interested - I always try and whitelist things when I'm building software. Although I have next to no background when it comes to security in particular.
    - purephase 14y ago
      Whitelisting is what Rails did to get around the mass assignment issue. It was solved for awhile, it just was not the default configuration setting. Whitelisting is what the rubygems folks are doing to work around this problem until a better implementation is put in-place in the YAML parser. Generally, it is a better solution but it is more difficult and can break a lot of dependencies if not implemented correctly.
    - tomjen3 14y ago
      Stupid me. I meant to write whitelisting. Yes, you are absolutely right.
pifflesnort 14y ago
> Is that seriously what happened? Surprisingly, yes: https://github.com/tenderlove/psych/issues/119 https://github.com/tenderlove/psych/issues/119 And the RubyGems folks are trying to handle this with whitelisting specific classes that the YAML parsing will still be allowed to instantiate: https://github.com/rubygems/rubygems.org/pull/516/files https://github.com/rubygems/rubygems.org/pull/516/files
- purephase 14y ago
  As a temporary workaround until Psych is updated. At least that's how I read it. We can either sit around throwing stones at them or pull up our sleeves and help. I'm not sure what there is to gain with the former.
  - tomjen3 14y ago
    Rails needs to die. It is super nice to code in (for a certain class of problems, ie. CRUD apps) and the language is awesome but it is too big and insecure to use.
    - jroes 14y ago
      I'm willing to bet if you put someone like benmmurphy, ptacek, or homakov in your codebase he'll have you begging for a web framework in hours.
      - newman314 14y ago
        I wonder if various companies pooled money for a comprehensive audit of rails by ptacek etc., one would think that's a win-win for all.
        thibaut_barrere 14y ago
        I wondered exactly the same thing, a security-chase kickstarter or similar.
    - 14y ago
homakov 14y ago
> It sounds oddly similar to the Rails issue from about a year ago (the one in which the reporter was able to commit to master on Github) Hey, yes, yaml bug is _very_ similar. Whitelist is better than no list at all

purephase 14y ago

Different issue altogether. It was mass-assignment wherein the default Rails config did not have the whitelist enabled by default. The howto is here: http://homakov.blogspot.ca/2012/03/how-to.html http://homakov.blogspot.ca/2012/03/how-to.html

chimeracoder 14y ago
I know it was a different vulnerability - I was asking more whether the same developer(s) was/were responsible, since this seems to be a comment pattern that I'm hearing with regards to the initial response to the vulnerabilities.
tomjen3 14y ago
Actually it is the same issue as basically all other security issues in web programming (attack on crypto aside): Failure to blacklist non-conforming input. Really, it is that simple and that complicated.
- dos1 14y ago
  Wouldn't whitelisting conforming input be a better approach? I realize it may be more difficult, but wouldn't that be more secure? Edit: I'm genuinely interested - I always try and whitelist things when I'm building software. Although I have next to no background when it comes to security in particular.
  - purephase 14y ago
    Whitelisting is what Rails did to get around the mass assignment issue. It was solved for awhile, it just was not the default configuration setting. Whitelisting is what the rubygems folks are doing to work around this problem until a better implementation is put in-place in the YAML parser. Generally, it is a better solution but it is more difficult and can break a lot of dependencies if not implemented correctly.
  - tomjen3 14y ago
    Stupid me. I meant to write whitelisting. Yes, you are absolutely right.

pifflesnort 14y ago

> Is that seriously what happened? Surprisingly, yes: https://github.com/tenderlove/psych/issues/119 https://github.com/tenderlove/psych/issues/119 And the RubyGems folks are trying to handle this with whitelisting specific classes that the YAML parsing will still be allowed to instantiate: https://github.com/rubygems/rubygems.org/pull/516/files https://github.com/rubygems/rubygems.org/pull/516/files

purephase 14y ago
As a temporary workaround until Psych is updated. At least that's how I read it. We can either sit around throwing stones at them or pull up our sleeves and help. I'm not sure what there is to gain with the former.
- tomjen3 14y ago
  Rails needs to die. It is super nice to code in (for a certain class of problems, ie. CRUD apps) and the language is awesome but it is too big and insecure to use.
  - jroes 14y ago
    I'm willing to bet if you put someone like benmmurphy, ptacek, or homakov in your codebase he'll have you begging for a web framework in hours.
    - newman314 14y ago
      I wonder if various companies pooled money for a comprehensive audit of rails by ptacek etc., one would think that's a win-win for all.
      - thibaut_barrere 14y ago
        I wondered exactly the same thing, a security-chase kickstarter or similar.
  - 14y ago

homakov 14y ago

> It sounds oddly similar to the Rails issue from about a year ago (the one in which the reporter was able to commit to master on Github) Hey, yes, yaml bug is _very_ similar. Whitelist is better than no list at all