Skip to content

Instantly share code, notes, and snippets.

@jsl

jsl/gist:4491687

Created January 9, 2013 08:57
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save jsl/4491687 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save jsl/4491687 to your computer and use it in GitHub Desktop.
Download ZIP
Fix security vulnerability CVE-2013-0156 in apps that don't need XML and YAML parameter parsing.
Raw
gistfile1.txt
# These MIME types, which we don't use, are vulnerable per CVE-2013-0156
ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML)
ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::YAML)
@jsl

jsl commented Jan 9, 2013

Copy link
Copy Markdown
Author

This should be put in config/initializers/disable_vulnerable_parameter_parsing.rb.

@fcoury

fcoury commented Jan 10, 2013

Copy link
Copy Markdown

It's my understanding that you don't need to disable YAML if you disable XML altogether. If you can't disable XML, then you can disable YAML.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment