Grape is also affected:
https://groups.google.com/forum/?fromgroups=#!topic/ruby-gra...
MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
11–20 of 26 posts
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#12I strongly recommend loading something like this in your Ruby applications: https://gist.github.com/4507129 It will prevent YAML.rb from instantiating arbitrary objects, which will close off this entire class of problems. Obviously, if you do use YAML as a serialization format for arbitrary objects, this won't work, but odds are you aren't doing that.
Unfortunately, it doesn't look like this patch works in Ruby 1.9, where YAML is actually the Psych module. Any Psych experts know how to make this 1.9-compatible?
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#13Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
I appreciate this comment more than I have words. Dawg.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#14Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Also bugsnag.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#15Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Though the 'twilio' gem does use HTTParty, 'twilio-ruby' doesn't. So just make sure to check your Gemspec.lock.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#16Hmm, I'm not sure you could say it has "the same vulnerability".
It has the same vulnerability if you pass untrusted input to it, okay.
But the point of the Rails vulnerabilty is that every Rails app, by default, was set up to accept external user input and run it through an XML parser. Even if you didn't realize it.
If you are using MultiXml, you may or may not be passing untrusted user input to it, depends on what you did with it.
Right?
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#17Hmm, I'm not sure you could say it has "the same vulnerability". It has the same vulnerability if you pass untrusted input to it, okay. But the point of the Rails vulnerabilty is that every Rails app, by default, was set up to accept external user input and run it through an XML parser. Even if you didn't realize it. If you are using MultiXml, you may or may not be passing untrusted user input to it, depends on what…
That's correct. But I'm planning to remove this functionality anyway, just to be safe. It's too easy to accidentally open this vulnerability and it's unclear what the valid use-case is for parsing YAML or symbols from XML.
When I implemented this functionality, it was only to be compatible with the Rails parser.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#18Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Quick clarification: The multi_xml gem has _not_ been updated, so there is nothing to upgrade, correct? Just the monkey-patch fix?
A new gem release is in the works and should be pushed tomorrow. In the mean time, you can use this workaround.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#19A version of multi_xml with this fix has been pushed:
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#20Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Quick clarification: The multi_xml gem has _not_ been updated, so there is nothing to upgrade, correct? Just the monkey-patch fix?
MultiXML version 0.5.2 is now released.