karmi/tire — pull request #267 by asterite (2012-03-07 18:31:34+00:00)
Title: Don't use to_sym in Tire::Results::Item, as keys from elastic search might provide from user input

Hi,

I see that Tire::Results::Item calls to_sym on every key-value pair retrieved from ElasticSearch.

I have an app where a user has sites on a map, and every site can have a bunch of user-defined properties. Those properties with their values get stored in ElasticSearch.

When those properties are retrieved from ElasticSearch they are first converted to Symbols. **This is a memory leak, because Symbols are never released. So, a malicious user could potentially generate sites with randomly generated user-defined properties, and so the memory will be filled of Symbols.**

In general, it's never good to use to_sym from user generated data.

The commit I made just used to_s instead. Since ElasticSearch already returns the json keys as strings, calling to_s just returns the string itself. When indexing by a symbol, I also invoke to_s, so that would be the only "performance problem" (but later that string can be freed).