Comment on Yaml.rb patch to block the rails exploit and most similar classes of exploitsparentComments−dandandan13yNot all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.
Comments
Not all of them but this prevents most of the YAML strings from being serialized into Ruby objects by way of a 'safe' whitelist.