Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-013

Unsafe deserialization via YAML.load or Oj object mode

criticalRubyCWE-502CVSS 9.8

What it detects

YAML.load or Oj in object mode on untrusted input can instantiate arbitrary Ruby objects.

How to fix

Use YAML.safe_load or Oj with :strict mode to reject arbitrary object instantiation.

Vulnerable — Shield flags thisimport_controller.rb
class ImportController < ApplicationController
  def create
    config = YAML.load(request.body.read)
    Import.run(config)
    head :ok
  end
end
Fixed — scans cleanimport_controller.rb
class ImportController < ApplicationController
  def create
    config = YAML.safe_load(request.body.read, permitted_classes: [Date, Time])
    Import.run(config)
    head :ok
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-013, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-013: Unsafe deserialization via YAML.load or Oj object mode — Zennoxa Shield