- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: ruby-security/unsafe-deserialization
Language: Ruby
Severity: Warning
Category: Security
This rule advises against the use of unsafe deserialization in Ruby, particularly with the Marshal.load
method. Deserialization is the process of converting data from a binary or string format back into an object. However, if the data was tampered with, it could lead to arbitrary code execution when the data is deserialized.
This is important because it can lead to serious security vulnerabilities. An attacker could exploit the deserialization process to execute malicious code, alter program flow, or perform other harmful actions. This is particularly dangerous if your application runs with high privileges.
To avoid this, use safe deserialization methods. Instead of using Marshal.load
, consider using JSON or YAML for serialization and deserialization, as they are safer. For example, you could use JSON.parse(data)
or YAML.load(data)
instead. Additionally, always ensure that the data you are deserializing comes from a trusted source.
obj = Marshal.load(data)
|
|
For more information, please read the Code Analysis documentation
Identify code vulnerabilities directly in yourVS Code editor
Identify code vulnerabilities directly inJetBrains products