diff options
| -rw-r--r-- | ChangeLog | 5 | ||||
| -rw-r--r-- | doc/security.rdoc | 2 |
2 files changed, 6 insertions, 1 deletions
@@ -1,3 +1,8 @@ +Tue Feb 5 10:15:00 2013 Zachary Scott <zachary@zacharyscott.net> + + * doc/security.rdoc: Grammatical error on security guide + Patch by Josh Bassett [Github fixes #245] + Tue Feb 5 10:00:00 2013 Zachary Scott <zachary@zacharyscott.net> * lib/racc/parser.rb: Update #do_parse and #yyparse from upstream diff --git a/doc/security.rdoc b/doc/security.rdoc index 32273c8a97..9f0ec5cd02 100644 --- a/doc/security.rdoc +++ b/doc/security.rdoc @@ -18,7 +18,7 @@ Ruby's +Marshal+ module provides methods for serializing and deserializing Ruby Never use +Marshal.load+ to deserialize untrusted or user supplied data. Because +Marshal+ can deserialize to almost any Ruby object and has full control over instance variables, it is possible to craft a malicious payload that executes code shortly after deserialization. -If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. If you need to deserialize other classes, you should do handle this manually. Never deserialize to a user specified class. +If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. If you need to deserialize other classes, you should handle this manually. Never deserialize to a user specified class. == +YAML+ |