mirror of
https://github.com/github/codeql.git
synced 2026-08-03 08:52:55 +02:00
17 lines
408 B
Ruby
17 lines
408 B
Ruby
require "ox"
|
|
|
|
class UsersController < ActionController::Base
|
|
# BAD - Ox.load is unsafe when the mode :object is set globally
|
|
def route0
|
|
xml_data = params[:key]
|
|
object = Ox.load xml_data
|
|
end
|
|
|
|
# GOOD - the unsafe mode set globally is overridden with an insecure mode passed as
|
|
# a call argument
|
|
def route1
|
|
xml_data = params[:key]
|
|
object = Ox.load xml_data, mode: :generic
|
|
end
|
|
end
|