Skip to content

fix JSON::GeneratorError - source sequence is illegal/malformed utf-8:#31

Open
sahilchopra wants to merge 2 commits intohumante:mainfrom
sahilchopra:master
Open

fix JSON::GeneratorError - source sequence is illegal/malformed utf-8:#31
sahilchopra wants to merge 2 commits intohumante:mainfrom
sahilchopra:master

Conversation

@sahilchopra
Copy link
Copy Markdown

#30

@stuarthannig
Copy link
Copy Markdown

https://ruby-doc.org/core-2.3.0/Marshal.html#module-Marshal-label-Security+considerations

Security considerations¶ ↑

By design, ::load can deserialize almost any class loaded into the Ruby process. In many cases this can lead to remote code execution if the Marshal data is loaded from an untrusted source.

As a result, ::load is not suitable as a general purpose serialization format and you should never unmarshal user supplied input or other untrusted data.

If you need to deserialize untrusted data, use JSON or another serialization format that is only able to load simple, ‘primitive’ types such as String, Array, Hash, etc. Never allow user input to specify arbitrary types to deserialize into.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants