Comment on Yaml.rb patch to block the rails exploit and most similar classes of exploitsComments−cdcarter13yCorrect me if I am wrong, but this solves the YAML half of the exploit but not the XML part, right? This is not a complete patch against the exploits?−dandandan13yNot all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.
Comments
Correct me if I am wrong, but this solves the YAML half of the exploit but not the XML part, right? This is not a complete patch against the exploits?
Not all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.