1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* doc/security.rdoc: Grammatical error on security guide

Browse Source 
Patch by Josh Bassett [Github fixes #245]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@39053 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
zzak 2013-02-05 01:14:52 +00:00
parent acd3f3e733
commit 47da37b0a0
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
Tue Feb 5 10:15:00 2013 Zachary Scott <zachary@zacharyscott.net>
* doc/security.rdoc: Grammatical error on security guide
Patch by Josh Bassett [Github fixes #245]
Tue Feb 5 10:00:00 2013 Zachary Scott <zachary@zacharyscott.net>
* lib/racc/parser.rb: Update #do_parse and #yyparse from upstream

2
doc/security.rdoc
View File

@ -18,7 +18,7 @@ Ruby's +Marshal+ module provides methods for serializing and deserializing Ruby
Never use +Marshal.load+ to deserialize untrusted or user supplied data. Because +Marshal+ can deserialize to almost any Ruby object and has full control over instance variables, it is possible to craft a malicious payload that executes code shortly after deserialization.
If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. If you need to deserialize other classes, you should do handle this manually. Never deserialize to a user specified class.
If you need to deserialize untrusted data, you should use JSON as it is only capable of returning 'primitive' types such as strings, arrays, hashes, numbers and nil. If you need to deserialize other classes, you should handle this manually. Never deserialize to a user specified class.
== +YAML+