Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove JSON.load/dump in favour of parse/generate #6

Merged
merged 2 commits into from
Jun 1, 2017

Conversation

hmac
Copy link
Contributor

@hmac hmac commented Jun 1, 2017

Cherry-picked from upstream; this fixes a security vuln where untrusted user input as job args could instantiate arbitrary Ruby classes.

@hmac hmac force-pushed the hmac/remove-json-load branch from 0b8f820 to c10d445 Compare June 1, 2017 17:37
@hmac
Copy link
Contributor Author

hmac commented Jun 1, 2017

@Sinjo updated. You won't like it as much but I think it's still safe, and compatible with MultiJson.

@hmac hmac merged commit 5bfb6d1 into master Jun 1, 2017
@hmac hmac deleted the hmac/remove-json-load branch June 1, 2017 18:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants