CVE-2013-1801: Permissions, Privileges, and Access Controls (CWE-264)
value: The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2013-04-09T20:55Z
Repository: https://github.com/jnunemaker/httparty
Language: Ruby
Files changed: History, examples/custom_parsers.rb, lib/httparty/parser.rb, spec/httparty/parser_spec.rb, spec/httparty/request_spec.rb, spec/httparty_spec.rb
Commit date: 2013-01-10 15:45:09 -0500
Commit message: Remove yaml due to possible security risk.

Diff: diff --git a/History b/History
index 09c2049..b896fcc 100644
--- a/History
+++ b/History
@@ -1,5 +1,9 @@
+== 0.10.0 2013-01-10
+* changes
+  * removed yaml support because of security risk (see rails yaml issues)
+
 == 0.9.0 2012-09-07
 * new
   * [support for connection adapters](https://github.com/jnunemaker/httparty/pull/157)
   * [allow ssl_version on ruby 1.9](https://github.com/jnunemaker/httparty/pull/159)
 
diff --git a/examples/custom_parsers.rb b/examples/custom_parsers.rb
index 3a91813..f6131a3 100644
--- a/examples/custom_parsers.rb
+++ b/examples/custom_parsers.rb
@@ -1,9 +1,9 @@
 class ParseAtom
   include HTTParty
 
-  # Support Atom along with the default parsers: xml, json, yaml, etc.
+  # Support Atom along with the default parsers: xml, json, etc.
   class Parser::Atom < HTTParty::Parser
     SupportedFormats.merge!({"application/atom+xml" => :atom})
 
     protected
 
diff --git a/lib/httparty/parser.rb b/lib/httparty/parser.rb
index 3b9e67e..42c218e 100644
--- a/lib/httparty/parser.rb
+++ b/lib/httparty/parser.rb
@@ -1,7 +1,7 @@
 module HTTParty
-  # The default parser used by HTTParty, supports xml, json, html, yaml, and
+  # The default parser used by HTTParty, supports xml, json, html, and
   # plain text.
   #
   # == Custom Parsers
   #
   # If you'd like to do your own custom parsing, subclassing HTTParty::Parser
@@ -43,12 +43,10 @@ module HTTParty
       'application/json'       => :json,
       'text/json'              => :json,
       'application/javascript' => :json,
       'text/javascript'        => :json,
       'text/html'              => :html,
-      'application/x-yaml'     => :yaml,
-      'text/yaml'              => :yaml,
       'text/plain'             => :plain
     }
 
     # The response body of the request
     # @return [String]
@@ -118,14 +116,10 @@ module HTTParty
       else
         MultiJson.decode(body)
       end
     end
 
-    def yaml
-      YAML.load(body)
-    end
-
     def html
       body
     end
 
     def plain
diff --git a/spec/httparty/parser_spec.rb b/spec/httparty/parser_spec.rb
index a72bbfd..4d6813d 100644
--- a/spec/httparty/parser_spec.rb
+++ b/spec/httparty/parser_spec.rb
@@ -153,15 +153,10 @@ describe HTTParty::Parser do
       MultiJson.should_receive(:respond_to?).with(:adapter).and_return(false)
       MultiJson.should_receive(:decode).with('body')
       subject.send(:json)
     end
 
-    it "parses yaml" do
-      YAML.should_receive(:load).with('body')
-      subject.send(:yaml)
-    end
-
     it "parses html by simply returning the body" do
       subject.send(:html).should == 'body'
     end
 
     it "parses plain text by simply returning the body" do
diff --git a/spec/httparty/request_spec.rb b/spec/httparty/request_spec.rb
index 9db7b72..f06a71f 100644
--- a/spec/httparty/request_spec.rb
+++ b/spec/httparty/request_spec.rb
@@ -223,16 +223,10 @@ describe HTTParty::Request do
       json = %q[{"books": {"book": {"name": "Foo Bar!", "id": "1234"}}}]
       @request.options[:format] = :json
       @request.send(:parse_response, json).should == {'books' => {'book' => {'id' => '1234', 'name' => 'Foo Bar!'}}}
     end
 
-    it 'should handle yaml automatically' do
-      yaml = "books: \n  book: \n    name: Foo Bar!\n    id: \"1234\"\n"
-      @request.options[:format] = :yaml
-      @request.send(:parse_response, yaml).should == {'books' => {'book' => {'id' => '1234', 'name' => 'Foo Bar!'}}}
-    end
-
     it "should include any HTTP headers in the returned response" do
       @request.options[:format] = :html
       response = stub_response "Content"
       response.initialize_http_header("key" => "value")
 
diff --git a/spec/httparty_spec.rb b/spec/httparty_spec.rb
index 484f4bc..130fb10 100644
--- a/spec/httparty_spec.rb
+++ b/spec/httparty_spec.rb
@@ -382,15 +382,10 @@ describe HTTParty do
     it "should allow json" do
       @klass.format :json
       @klass.default_options[:format].should == :json
     end
 
-    it "should allow yaml" do
-      @klass.format :yaml
-      @klass.default_options[:format].should == :yaml
-    end
-
     it "should allow plain" do
       @klass.format :plain
       @klass.default_options[:format].should == :plain
     end
 
@@ -401,11 +396,11 @@ describe HTTParty do
     end
 
     it 'should only print each format once with an exception' do
       lambda do
         @klass.format :foobar
-      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml, yaml")
+      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml")
     end
 
     it 'sets the default parser' do
       @klass.default_options[:parser].should be_nil
       @klass.format :json

Vulnerable code:   # Support Atom along with the default parsers: xml, json, yaml, etc.
  # The default parser used by HTTParty, supports xml, json, html, yaml, and
      'application/x-yaml'     => :yaml,
      'text/yaml'              => :yaml,
    def yaml
      YAML.load(body)
    end

    it "parses yaml" do
      YAML.should_receive(:load).with('body')
      subject.send(:yaml)
    end

    it 'should handle yaml automatically' do
      yaml = "books: \n  book: \n    name: Foo Bar!\n    id: \"1234\"\n"
      @request.options[:format] = :yaml
      @request.send(:parse_response, yaml).should == {'books' => {'book' => {'id' => '1234', 'name' => 'Foo Bar!'}}}
    end

    it "should allow yaml" do
      @klass.format :yaml
      @klass.default_options[:format].should == :yaml
    end

      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml, yaml")
Fixed code: == 0.10.0 2013-01-10
* changes
  * removed yaml support because of security risk (see rails yaml issues)

  # Support Atom along with the default parsers: xml, json, etc.
  # The default parser used by HTTParty, supports xml, json, html, and
      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml")