CVE-2013-1801 (published 2013-04-09T20:55Z)

The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/jnunemaker/httparty
commit_details: repo_url: https://github.com/jnunemaker/httparty
author: John Nunemaker
author_date: 2013-01-10 15:45:09-05:00
msg: Remove yaml due to possible security risk.
repository: repo_url: https://github.com/jnunemaker/httparty
repo_name: jnunemaker/httparty
description: :tada: Makes http fun again!
repo_language: Ruby
owner: jnunemaker
file_changes: filename: History
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+== 0.10.0 2013-01-10
+* changes
+  * removed yaml support because of security risk (see rails yaml issues)
+
 == 0.9.0 2012-09-07
 * new
   * [support for connection adapters](https://github.com/jnunemaker/httparty/pull/157)

programming_language: Markdown
filename: custom_parsers.rb
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 class ParseAtom
   include HTTParty
 
-  # Support Atom along with the default parsers: xml, json, yaml, etc.
+  # Support Atom along with the default parsers: xml, json, etc.
   class Parser::Atom < HTTParty::Parser
     SupportedFormats.merge!({"application/atom+xml" => :atom})
 

programming_language: Ruby
filename: parser.rb
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 module HTTParty
-  # The default parser used by HTTParty, supports xml, json, html, yaml, and
+  # The default parser used by HTTParty, supports xml, json, html, and
   # plain text.
   #
   # == Custom Parsers
@@ -45,8 +45,6 @@ module HTTParty
       'application/javascript' => :json,
       'text/javascript'        => :json,
       'text/html'              => :html,
-      'application/x-yaml'     => :yaml,
-      'text/yaml'              => :yaml,
       'text/plain'             => :plain
     }
 
@@ -120,10 +118,6 @@ module HTTParty
       end
     end
 
-    def yaml
-      YAML.load(body)
-    end
-
     def html
       body
     end

programming_language: Ruby
filename: parser_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -155,11 +155,6 @@ describe HTTParty::Parser do
       subject.send(:json)
     end
 
-    it "parses yaml" do
-      YAML.should_receive(:load).with('body')
-      subject.send(:yaml)
-    end
-
     it "parses html by simply returning the body" do
       subject.send(:html).should == 'body'
     end

programming_language: Ruby
filename: request_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -225,12 +225,6 @@ describe HTTParty::Request do
       @request.send(:parse_response, json).should == {'books' => {'book' => {'id' => '1234', 'name' => 'Foo Bar!'}}}
     end
 
-    it 'should handle yaml automatically' do
-      yaml = "books: \n  book: \n    name: Foo Bar!\n    id: \"1234\"\n"
-      @request.options[:format] = :yaml
-      @request.send(:parse_response, yaml).should == {'books' => {'book' => {'id' => '1234', 'name' => 'Foo Bar!'}}}
-    end
-
     it "should include any HTTP headers in the returned response" do
       @request.options[:format] = :html
       response = stub_response "Content"

programming_language: Ruby
filename: httparty_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -384,11 +384,6 @@ describe HTTParty do
       @klass.default_options[:format].should == :json
     end
 
-    it "should allow yaml" do
-      @klass.format :yaml
-      @klass.default_options[:format].should == :yaml
-    end
-
     it "should allow plain" do
       @klass.format :plain
       @klass.default_options[:format].should == :plain
@@ -403,7 +398,7 @@ describe HTTParty do
     it 'should only print each format once with an exception' do
       lambda do
         @klass.format :foobar
-      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml, yaml")
+      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml")
     end
 
     it 'sets the default parser' do

programming_language: Ruby