This rule advises against the use of unsafe deserialization in Ruby, particularly with the Marshal.load method. Deserialization is the process of converting data from a binary or string format back into an object. However, if the data was tampered with, it could lead to arbitrary code execution when the data is deserialized.
This is important because it can lead to serious security vulnerabilities. An attacker could exploit the deserialization process to execute malicious code, alter program flow, or perform other harmful actions. This is particularly dangerous if your application runs with high privileges.
To avoid this, use safe deserialization methods. Instead of using Marshal.load, consider using JSON or YAML for serialization and deserialization, as they are safer. For example, you could use JSON.parse(data) or YAML.load(data) instead. Additionally, always ensure that the data you are deserializing comes from a trusted source.
Non-Compliant Code Examples
obj=Marshal.load(data)
Compliant Code Examples
# Safe: using JSON instead of Marshal for deserializationobj=JSON.parse(data)
원활한 통합. Datadog Code Security 사용해 보기
Datadog Code Security
이 규칙을 사용해 Datadog Code Security로 코드 분석해 보기
이 규칙의 사용법
1
2
rulesets:- ruby-security # Rules to enforce Ruby security.
리포지토리 루트에서 위의 콘텐츠를 사용해 static-analysis.datadog.yml 생성
Datadog의 무료 IDE Plugins를 사용하거나 Code Security 스캔을 CI 파이프라인에 추가
