philnash/bitly — pull request #34 by urbanautomaton (2013-02-01 18:15:15+00:00)
Title: Replace crack with multi_json

The crack gem uses an extracted copy of an outdated Rails JSON parser, which uses YAML as a backend. This is vulnerable to arbitrary code execution in certain contexts:

https://groups.google.com/forum/#!topic/rubyonrails-security/1h2DR63ViGo

While I admit it's highly unlikely that bit.ly API responses will contain malicious input, I would very much like to be able to use the bitly gem without needing to install an unsafe dependency. This patch replaces crack with multi_json, which intelligently selects from the locally available JSON backends, placing minimal constraints on client dependencies.

I wasn't sure if updating the gemspec was the right thing to do - I figured it was best on grounds of consistency. Apologies if not; I'm happy to amend as necessary.

Cheers (and thanks for providing this software!),
Simon