[ruby-core:113246] [Ruby master Feature#19528] `JSON.load` defaults are surprising (`create_additions: true`)

Issue #19528 has been updated by duerst (Martin D=FCrst).





I have some very vague recollection that we had a similar issue quite a lon=
g time ago. I seem to remember that @tenderlovemaking was somewhat involved=
. It may have been YAML, or JSON. It may have been the load method or anoth=
er method. What I remember of the discussion then was that we devised a pla=
n to gradually move from unsafe being the default to safe being the default=
. I'm sorry I currently don't have the time to try and find the relevant is=
sue.



----------------------------------------

Feature #19528: `JSON.load` defaults are surprising (`create_additions: tru=
e`)

https://bugs.ruby-lang.org/issues/19528#change-102801



* Author: byroot (Jean Boussier)

* Status: Open

* Priority: Normal

----------------------------------------

I'm not sure if it was actually intended, but there's some tacit naming con=
vention for serializers in Ruby to use `load` and `dump` as methods, likely=
 inspired from `Marshal` and `YAML`.



Because of this it's extremely common to see code that uses `JSON.load` exp=
ecting a simple, no surprise, and safe JSON parsing.



However that's `JSON.parse`.



`JSON.load` has this very surprising behavior (albeit perfectly documented)=
, of de-serializing more complex types:





```ruby

>> JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')

=3D> "Hello"

```



It's particularly weird because aside from the `String` extension that is e=
agerly defined, for other types you have to `require "json/add/core"`.



Seasoned Ruby developers know about this of course, and [it is banned by va=
rious linters](https://www.rubydoc.info/gems/rubocop/RuboCop/Cop/Security/J=
SONLoad), but it keeps popping regularly in [gems security releases](https:=
//discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untr=
usted-data-vulnerability-in-kredis-json/82467) and such.



### Proposal



Assuming entirely removing this feature is not an option, I think `json 2.x=
` should warn when this feature is actually being used, and `json 3.x` shou=
ld disable it by default and require users to explicitly use `JSON.load(str=
, create_additions: true)` to keep the old behavior.







--=20

https://bugs.ruby-lang.org/

 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-c=
ore.ml.ruby-lang.org/