safe_yaml 0.2.1 → 0.2.2

data/README.md

@@ -0,0 +1,41 @@
+SafeYAML
+========
+
+*Parse (simple) YAML safely, without that pesky arbitrary code execution vulnerability.*
+
+***
+
+The **safe_yaml** gem offers an alternative to `YAML.load` suitable for accepting user input. Unlike `YAML.load`, `YAML.safe_load` will *not* expose your Ruby app to arbitrary code execution exploits (such as [the one recently discovered in Rails](http://www.reddit.com/r/netsec/comments/167c11/serious_vulnerability_in_ruby_on_rails_allowing/)).
+
+Observe!
+
+```ruby
+class ExploitableMap
+  def []=(key, value)
+    self.class.class_eval <<-EOS
+      def #{key}
+        return "#{value}"
+      end
+    EOS
+  end
+end
+```
+
+If your application were to contain code like this and use `YAML.load` anywhere on user input, an attacker could craft a YAML string to execute any code (yes, including `system("unix command")`) on your servers:
+
+    > yaml = <<-EOYAML
+    > --- !ruby/hash:ExploitableMap
+    > "foo; end; puts %(I'm in yr system!); def bar": "baz"
+    > EOYAML
+    => "--- !ruby/hash:ExploitableMap\n\"foo; end; puts %(I'm in yr system!); def bar\": \"baz\"\n"
+    
+    > YAML.load(yaml)
+    I'm in yr system!
+    => #<ExploitableMap:0x007ffadca0ca10> 
+
+With `YAML.safe_load`, that attacker would be thwarted:
+
+    > YAML.safe_load(yaml)
+    => {"foo; end; puts %(I'm in yr system!); def bar"=>"baz"} 
+
+SafeYAML requires Ruby 1.9.2 or newer. Maybe I'll get around to writing a Syck handler eventually, at which point it could support older versions as well.

data/lib/safe_yaml/handler.rb

@@ -1,3 +1,4 @@
+require "psych"
 require "yaml"
 
 module SafeYAML

data/lib/safe_yaml/version.rb

@@ -1,3 +1,3 @@
 module SafeYAML
-  VERSION = "0.2.1"
+  VERSION = "0.2.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safe_yaml
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
   prerelease: 
 platform: ruby
 authors:
@@ -21,6 +21,7 @@ files:
 - .gitignore
 - Gemfile
 - Gemfile.lock
+- README.md
 - Rakefile
 - lib/safe_yaml.rb
 - lib/safe_yaml/handler.rb