Yaml.rb patch to block the rails exploit and most similar classes of exploitsgist.github.com 17 pointsnelhage13 years ago2 commentsSaveHideCopy link On HNComments−cdcarter13yCorrect me if I am wrong, but this solves the YAML half of the exploit but not the XML part, right? This is not a complete patch against the exploits?−dandandan13yNot all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.
Comments
Correct me if I am wrong, but this solves the YAML half of the exploit but not the XML part, right? This is not a complete patch against the exploits?
Not all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.