Skip to content

Instantly share code, notes, and snippets.

@jsl

jsl/gist:4491687

Created January 9, 2013 08:57
Show Gist options
  • Save jsl/4491687 to your computer and use it in GitHub Desktop.
Save jsl/4491687 to your computer and use it in GitHub Desktop.
Download ZIP
Fix security vulnerability CVE-2013-0156 in apps that don't need XML and YAML parameter parsing.
Raw
gistfile1.txt
# These MIME types, which we don't use, are vulnerable per CVE-2013-0156
ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML)
ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::YAML)
@jsl
Copy link
Author

jsl commented Jan 9, 2013

This should be put in config/initializers/disable_vulnerable_parameter_parsing.rb.

@fcoury
Copy link

fcoury commented Jan 10, 2013

It's my understanding that you don't need to disable YAML if you disable XML altogether. If you can't disable XML, then you can disable YAML.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment