4 ms·

I'm not sure if we're talking about a language problem here. The tools are there for you to use them in the proper way and there's always a chance that someone

by reidrac 14y ago

I'm not sure if we're talking about a language problem here. The tools are there for you to use them in the proper way and there's always a chance that someone misunderstands how things work. Perl Data::Dumper can be used with eval for serialization, but it is a bad idea. Just like using pickle in Python (most of the time, at least). No matter what you do, there's always room for someone doing something stupid. So I rather have the tools.

Argorak 14y ago
Saying that it is a language problem might be true for that specific case. YAML#load and #dump do Object marshaling, which is always dangerous when the marshaled objects come from untrusted sources and parsed without a template. Similar techniques exist in almost all other languages and object instantiation attacks are nothing unheard of. So most of the bile is unwarranted, unless you are asking for bile back if something like this happens in your language. Everyone who is ranting about the security bugs of other projects clearly lacks the humility that Nick Coghlan is asking for in the comments. But the reason why this specific one is very widespread is actually a cultural one: YAML was propagated as a very convenient serialization format despite the described property, especially as it was in stdlib very early. It turned into one of Rubys beloved conventions. E.g. some static website generators like Jekyll use YAML for meta data, called "front matter" (they use safe_yaml now, don't try), Rubygems used it to dump their specs, etc. Combine that with the fact that Rails activated certain parameter parsers without the users knowledge (by convention, again) and made everyone vulnerable and you have a recipe for desaster. This is hard to fix, but thats the pain of suddenly being under attack. But instead of all the hate, members of other communities should take away these learnings and educate everyone they know that uses Ruby about these topics. In clear words, but without hate.

by reidrac 14y ago

Argorak 14y ago

Saying that it is a language problem might be true for that specific case. YAML#load and #dump do Object marshaling, which is always dangerous when the marshaled objects come from untrusted sources and parsed without a template. Similar techniques exist in almost all other languages and object instantiation attacks are nothing unheard of. So most of the bile is unwarranted, unless you are asking for bile back if something like this happens in your language. Everyone who is ranting about the security bugs of other projects clearly lacks the humility that Nick Coghlan is asking for in the comments. But the reason why this specific one is very widespread is actually a cultural one: YAML was propagated as a very convenient serialization format despite the described property, especially as it was in stdlib very early. It turned into one of Rubys beloved conventions. E.g. some static website generators like Jekyll use YAML for meta data, called "front matter" (they use safe_yaml now, don't try), Rubygems used it to dump their specs, etc. Combine that with the fact that Rails activated certain parameter parsers without the users knowledge (by convention, again) and made everyone vulnerable and you have a recipe for desaster. This is hard to fix, but thats the pain of suddenly being under attack. But instead of all the hate, members of other communities should take away these learnings and educate everyone they know that uses Ruby about these topics. In clear words, but without hate.