[ruby-core:51364] [ruby-trunk - Feature #7677] YAML load mode that does instantiate Ruby

Issue #7677 has been updated by trans (Thomas Sawyer).


=begin
Is that a viable option for general usage?

Let me give an example of there where this issue becomes a problem. I received an email a couple of days ago:

  You may have read about the recent Rails security issue. I had no idea
  YAML.load enabled remote code execution when given user input.

  The same problem is in Gollum as a result of your page metadata pull
  request that I approved. I had to disable it in Gollum today and
  released 2.4.11 with the fix. Do you think it's worth updating page
  metadata or should it be removed?

The conclusion of our conversation was pretty simple. YAML would have to go unless there is a fix, and JSON would be used instead. I hate to see that happen, but there isn't much I can do about it other then ask for a fix.

Some links related to this:
* http://www.insinuator.net/2013/01/rails-yaml/
* http://news.ycombinator.com/item?id=5028218
* https://github.com/github/gollum/pull/419

=end
----------------------------------------
Feature #7677: YAML load mode that does instantiate Ruby 
https://bugs.ruby-lang.org/issues/7677#change-35334

Author: trans (Thomas Sawyer)
Status: Open
Priority: Normal
Assignee: 
Category: lib
Target version: next minor


See https://makandracards.com/makandra/892-never-use-yaml-load-with-user-input

I suggest that YAML.load and YAML.load_file have an optional mode that will allow the YAML to load but not instantiate `!ruby/object:` tags, nor any registered tags. To go with this there could be a way to see what the tag is after having been loaded.



-- 
http://bugs.ruby-lang.org/