From d0a62f3ced7560daba2ad546d83f0479a5ae2cf2 Mon Sep 17 00:00:00 2001 From: Florian Frank Date: Mon, 4 Feb 2013 23:28:30 +0100 Subject: Security fix create_additons/JSON::GenericObject --- lib/json/common.rb | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) (limited to 'lib/json/common.rb') diff --git a/lib/json/common.rb b/lib/json/common.rb index 03892d9..65a74a1 100644 --- a/lib/json/common.rb +++ b/lib/json/common.rb @@ -299,21 +299,28 @@ module JSON attr_accessor :load_default_options end self.load_default_options = { - :max_nesting => false, - :allow_nan => true, - :quirks_mode => true, + :max_nesting => false, + :allow_nan => true, + :quirks_mode => true, + :create_additions => true, } # Load a ruby data structure from a JSON _source_ and return it. A source can # either be a string-like object, an IO-like object, or an object responding # to the read method. If _proc_ was given, it will be called with any nested - # Ruby object as an argument recursively in depth first order. The default - # options for the parser can be changed via the load_default_options method. + # Ruby object as an argument recursively in depth first order. To modify the + # default options pass in the optional _options_ argument as well. + # + # BEWARE: This method is meant to serialise data from trusted user input, + # like from your own database server or clients under your control, it could + # be dangerous to allow untrusted users to pass JSON sources into it. The + # default options for the parser can be changed via the load_default_options + # method. # # This method is part of the implementation of the load/dump interface of # Marshal and YAML. - def load(source, proc = nil) - opts = load_default_options + def load(source, proc = nil, options = {}) + opts = load_default_options.merge options if source.respond_to? :to_str source = source.to_str elsif source.respond_to? :to_io -- cgit v1.2.1