laserlemon/simple_oauth — pull request #13 by notEthan (2014-03-09 03:45:16+00:00)
Title: don't symbolize arbitrary user-supplied strings

the symbolization of arbitrary user-supplied strings is a DoS / memory exhaustion vulnerability. this patch limits the symbols which SimpleOAuth uses for keys in the .parse method to those that are recognized attributes of an oauth authorization header.

this does create some inconsistency, where some parts of the hash returned from .parse will be strings and others will be symbols, but this seems necessary: the recognized keys must remain symbols to avoid breaking pretty much every application using this library; the unrecognized keys must not be symbols to avoid the vulnerability.