Post #2525791
2026-04-23 13:35 UTC
https://social.heise.de/@heiseonlineenglish/116453360304404198
Looks like a deserialization gadget in ERB.
If you are using Marshal directly with user input... please stop. If you are still using Marshal for Rails cookies... it's been ages, move to (signed, encrypted) JSON.
Edit: I'm not quite awake yet. Use server-side storage for session cookie data!
#ruby #security
Replies (0)
No replies.