From: James Britt Date: 2008-08-24T08:51:43+09:00 Subject: Re: [ANN] DoS vulnerability in REXML Urabe Shyouhei wrote: > James Britt wrote: >> Then the original post is misleading in emphasizing Rails. >> >> Lots of people use REXML on the Web outside of Rails, so the effect on >> Rails is incidental to the real problem and should have been omitted >> for clarity. > > Incidental yes, but that doesn't mean Rails users must be ignored. > Perhaps web-admins should not omit Rails workarounds, but also add a > note that non-Rails apps can suffer this issue. Not ignored, but the report should focus on the risk to any application using Ruby's standard REXML library, including, but not limited to, Web applications, such as as Merb, Ramaze, Rails, and others that may be accepting arbitrary XML from outside source. -- James Britt www.happycamperstudios.com - Wicked Cool Coding www.jamesbritt.com - Playing with Better Toys www.ruby-doc.org - Ruby Help & Documentation www.rubystuff.com - The Ruby Store for Ruby Stuff