28 ms·

Is there no hardened version of Psych which lets you either disable object deserialization, or whitelist classes? That would seem like the safest option right n

by s1kx 14y ago

Is there no hardened version of Psych which lets you either disable object deserialization, or whitelist classes? That would seem like the safest option right now to guard against coming vulnerabilities in Rails in this regard.

trapexit 14y ago
This is currently being discussed on https://github.com/tenderlove/psych/issues/119 https://github.com/tenderlove/psych/issues/119 There is also https://github.com/dtao/safe_yaml https://github.com/dtao/safe_yaml (hat tip @patio11, who also points out that this has not been audited for completeness/correctness)