funny-falcon/activerecord-postgresql-arrays — Issue #2: Security vulnerability by using activerecord-postgresql-arrays
Author: senotrusov
Created: 2011-12-03 16:42:06+00:00
State: open

Since funny-falcon has not provided an email address, I will send this message to the public.

I wonder how naive one must be to use `eval` in parsing database output.

Just store `'{"foo", "bar", "#{1+1}"}'` to database and see how it will be retrieved by using that plugin.