Bug #3234: YAML fails to load a dumped string (exception)

• Status: Closed
• Assignee: tenderlovemaking (Aaron Patterson)

[hdm (HD Moore)]

=begin
A specific (but common) sequence of bytes cannot be loaded after being dumped by YAML. This has a serious impact on AR serialization when a malicious user can input a string to be serialized. It also happens to break my app. The bug occurs on 1.8.7, 1.9.1-stable, and trunk.

require 'yaml'

str = ["0a20200a202020566f6c756d6520696e206472697665204320686173206e6f206c6162656c2e0d0a202020566f6c756d652053657269616c204e756d62657220697320414337392d393934320d0a20200d0a2020204469726563746f7279206f6620633a5c0d0a20200d0a202030372f31362f32303038202031303a333520504d202020202020202020202020202020202030204155544f455845432e4241540d0a202030332f32332f32303130202030333a303920504d20202020202020202020202033332c3935362062756c6b77686f69732e7064660d0a202030372f31362f32303038202031303a333520504d20202020202020202020202020202020203020434f4e4649472e5359530d0a202030372f31372f32303038202030383a343020414d202020203c4449523e20202020202020202020446f63756d656e747320616e642053657474696e67730d0a202030352f30312f32303130202031323a353620504d202020203c4449523e202020202020202020206d65746173706c6f69740d0a202030352f30312f32303130202031323a353120504d202020203c4449523e2020202020202020202050726f6772616d2046696c65730d0a202031322f30332f32303039202030373a303720414d202020203c4449523e2020202020202020202057494e444f57530d0a2020202020202020202020202020202020332046696c6528732920202020202020202033332c3935362062797465730d0a20202020202020202020202020202020203420446972287329202031352c3034352c3832342c35313220627974657320667265650d0a20200a20200a"].pack("H*")

YAML.load(YAML.dump_stream(str))


Stack trace:
' (ArgumentError)by-1.9.1-head/lib/ruby/1.9.1/syck.rb:135:in load': syntax error on line 8, col 2: 07/16/2008 10:35 PM 0 AUTOEXEC.BAT
from /home/hdm/.rvm/ruby-1.9.1-head/lib/ruby/1.9.1/syck.rb:135:in load' from yaml_death.rb:5:in

'
=end

[nobu (Nobuyoshi Nakada)]

• Category set to ext
• Status changed from Open to Assigned
• Assignee set to tenderlovemaking (Aaron Patterson)

=begin
Psych seems not using complex format, so this error doesn't occur.
But it can't load the data dumped by Syck, too.
I'm not sure where is the primary cause.
=end

[hdm (HD Moore)]

=begin
YAML appears to be destructive to any string containing multiple \n's as well (loading it will have less bytes than dumping it)
=end

[coatl (caleb clausen)]

=begin
Is this perhaps related to (or the same as) #1311, which related to newlines being handled badly by syck?
=end

[nobu (Nobuyoshi Nakada)]

• Status changed from Assigned to Closed

=begin
Exactly.
=end