From: "trans (Thomas Sawyer)" Date: 2013-01-11T00:05:36+09:00 Subject: [ruby-core:51364] [ruby-trunk - Feature #7677] YAML load mode that does instantiate Ruby Issue #7677 has been updated by trans (Thomas Sawyer). =begin Is that a viable option for general usage? Let me give an example of there where this issue becomes a problem. I received an email a couple of days ago: You may have read about the recent Rails security issue. I had no idea YAML.load enabled remote code execution when given user input. The same problem is in Gollum as a result of your page metadata pull request that I approved. I had to disable it in Gollum today and released 2.4.11 with the fix. Do you think it's worth updating page metadata or should it be removed? The conclusion of our conversation was pretty simple. YAML would have to go unless there is a fix, and JSON would be used instead. I hate to see that happen, but there isn't much I can do about it other then ask for a fix. Some links related to this: * http://www.insinuator.net/2013/01/rails-yaml/ * http://news.ycombinator.com/item?id=5028218 * https://github.com/github/gollum/pull/419 =end ---------------------------------------- Feature #7677: YAML load mode that does instantiate Ruby https://bugs.ruby-lang.org/issues/7677#change-35334 Author: trans (Thomas Sawyer) Status: Open Priority: Normal Assignee: Category: lib Target version: next minor See https://makandracards.com/makandra/892-never-use-yaml-load-with-user-input I suggest that YAML.load and YAML.load_file have an optional mode that will allow the YAML to load but not instantiate `!ruby/object:` tags, nor any registered tags. To go with this there could be a way to see what the tag is after having been loaded. -- http://bugs.ruby-lang.org/