rubyamf/rocketamf — Issue #9: abused to_sym can get server easily attacked when deserializing data from client
Author: asinbow
Created: 2012-01-12 02:44:21+00:00
State: open

We are using rocketamf on our server to serialize data from remote client, which is the most case, but have found it could be easily attack by abused String::to_sym.
File:
lib/rocketamf/pure/deserializer.rb => to_sym
ext/rocketamf_ext/deserializer.c => rb_str_intern
As it is, rocketamf will convert every key in an object to sym, but in Ruby, the memory of a symbol will never be released. So, when a client transfer malicious data to server, our server will certainly get DoS attacked.

Maybe solutions:
1. no more use to_sym, only string as key. Some old code use rocketamf will not work.
2. to_sym only if the special symbol already exists. This maybe a good solution, but sometimes make something unexpected.
3. give an extra argument for deserializing amf object.