[#51329] [ruby-trunk - Feature #7677][Open] YAML load mode that does instantiate Ruby — "trans (Thomas Sawyer)" <transfire@...>
7 messages
2013/01/09
[#51347] [ruby-trunk - Bug #7679][Open] IRB history is broken — "zzak (Zachary Scott)" <zachary@...>
15 messages
2013/01/10
[#51348] [ruby-trunk - Bug #7680][Open] IRB autocompletion doesn't autocomplete methods — "zzak (Zachary Scott)" <zachary@...>
8 messages
2013/01/10
[#51389] [ruby-trunk - Bug #7688][Open] Error hiding with rb_rescue() on Comparable#==, #coerce and others — "Eregon (Benoit Daloze)" <redmine@...>
34 messages
2013/01/11
[#59674] [ruby-trunk - Feature #7688] Error hiding with rb_rescue() on Comparable#==, #coerce and others
— "marcandre (Marc-Andre Lafortune)" <ruby-core@...>
2014/01/09
[#59675] [ruby-trunk - Feature #7688] Error hiding with rb_rescue() on Comparable#==, #coerce and others
— "marcandre (Marc-Andre Lafortune)" <ruby-core@...>
2014/01/09
[#59679] Re: [ruby-trunk - Feature #7688] Error hiding with rb_rescue() on Comparable#==, #coerce and others
— "Martin J. Dürst" <duerst@...>
2014/01/10
On 2014/01/10 7:42, marcandre (Marc-Andre Lafortune) wrote:
[#51391] [ANN] Implementer Meeting — Aaron Patterson <tenderlove@...>
Hey everyone,
9 messages
2013/01/11
[#51421] Re: [ANN] Implementer Meeting
— Mark Rada <markrada26@...>
2013/01/14
Hello Aaron,
[#51431] Re: [ANN] Implementer Meeting
— Marc-Andre Lafortune <ruby-core-mailing-list@...>
2013/01/14
I'm worried about issues with Enumerator::Lazy. Should we discuss this at
[#51399] [ruby-trunk - Bug #7689][Open] Crash @enumerator.so with ruby 1.9.3/thin/RoR 3.2.11 — "saepia (Marcin Lewandowski)" <marcin@...>
6 messages
2013/01/12
[#51441] [ruby-trunk - Bug #7699][Open] rubyspec failed: BigDecimal#divmod Can be reversed with * and + — "mrkn (Kenta Murata)" <muraken@...>
8 messages
2013/01/15
[#51453] [REMINDER] Implemeter Meeting — Aaron Patterson <tenderlove@...>
Hey everyone,
5 messages
2013/01/15
[#51454] [CommonRuby - Feature #7701][Open] Non-optional (required) keyword args — "headius (Charles Nutter)" <headius@...>
31 messages
2013/01/15
[#53256] [CommonRuby - Feature #7701] Non-optional (required) keyword args
— "headius (Charles Nutter)" <headius@...>
2013/03/09
[#51496] Ruby 2.0 Meeting Schedule — Aaron Patterson <tenderlove@...>
At the Implemeters Meeting, we talked about meeting again in 2 weeks
5 messages
2013/01/17
[#51497] Schedule next developer meeting — Aaron Patterson <tenderlove@...>
At the last meeting, we agreed upon having another meeting four weeks
5 messages
2013/01/17
[#51499] [ruby-trunk - Feature #7712][Open] Add .txt extensions to all plain-text documentation files for Windows users — "postmodern (Hal Brodigan)" <postmodern.mod3@...>
9 messages
2013/01/18
[#51545] Haiku port problem — Paulo Geyer <paulogeyer@...>
I'm trying to port ruby 1.9.3-p347 to Haiku (http://www.haiku-os.org/)
5 messages
2013/01/21
[#51578] [ruby-trunk - Bug #7729][Open] __dir__ returns a absolute dir path — "authorNari (Narihiro Nakamura)" <authorNari@...>
8 messages
2013/01/23
[#51623] [ruby-trunk - Feature #7739][Open] Define Hash#| as Hash#reverse_merge in Rails — "alexeymuranov (Alexey Muranov)" <redmine@...>
24 messages
2013/01/24
[#51726] [ruby-trunk - Feature #7751][Open] How to encapsulate File.delete and File.rename into one 'transaction'? — "mghomn (Justin Peal)" <yujianbin@...>
5 messages
2013/01/29
[#51735] [ruby-trunk - Bug #7752][Open] Rational/Float/Fixnum/Bignum `.to_s.encoding` is US-ASCII — "coffeejunk (Maximilian Haack)" <mxhaack@...>
6 messages
2013/01/29
[ruby-core:51767] Re: [ruby-trunk - Bug #7759][Open] Marshal.load is not documented to be dangerous
From:
KOSAKI Motohiro <kosaki.motohiro@...>
Date:
2013-01-31 00:34:26 UTC
List:
ruby-core #51767
> Marshal.load is incredibly powerful, and also incredibly dangerous. > > Unfortunately, many developers use it inappropriately and unmarshal user input. This can lead to a wide range of vulnerabilities, including remote code execution. > > Marshal.load should be documented as dangerous and the documentation should also mention that it should only be used on trusted data. Makes sense. Can you please consider to write down the explanation?