hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Clarify that deserialization following a schema is safe

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-05-08 14:06:16 +01:00
parent 4e47f7706d
commit ed9477aac9
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp
View File

@@ -7,6 +7,14 @@ Deserializing untrusted data using any method that allows the construction of
arbitrary objects is easily exploitable and, in many cases, allows an attacker
to execute arbitrary code.
</p>
<p>
Note that a deserialization method is only dangerous if it can instantiate
arbitrary classes or objects. Serialization frameworks that use a schema to instantiate
only expected, predefined types are generally not tracked by this query. Such
frameworks are generally safe with respect to arbitrary-class-instantiation and
gadget-chain attacks when the schema is trusted and does not permit
user-controlled type resolution.
</p>
</overview>
<recommendation>
@@ -31,7 +39,7 @@ safely be used.
If deserializing an untrusted XML document using the <code>ox</code> gem,
do not use <code>parse_obj</code> and <code>load</code> using the non-default :object mode.
Instead use the <code>load</code> method in the default mode or better explicitly set a safe
mode such as :hash.
mode such as :hash.
</p>
<p>