Skip to content

Commit 197f075

Browse files
authored
Don't unmarshal classes that don't include XMLRPC::Marshal (#36)
If we unmarshal all classes, evil clients may run unexpected code. See https://hackerone.com/reports/1189419 for details.
1 parent 5cc6a7e commit 197f075

File tree

4 files changed

+28
-0
lines changed

4 files changed

+28
-0
lines changed

lib/xmlrpc/parser.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ def self.struct(hash)
113113
begin
114114
mod = Module
115115
klass.split("::").each {|const| mod = mod.const_get(const.strip)}
116+
return hash unless mod.included_modules.include?(XMLRPC::Marshallable)
116117

117118
obj = mod.allocate
118119

test/data/marshallable.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
- true
3+
- ___class___: Gem::Requirement

test/data/marshallable.xml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0" ?>
2+
<methodResponse>
3+
<params>
4+
<param>
5+
<value>
6+
<struct>
7+
<member>
8+
<name>___class___</name>
9+
<value>
10+
<string>Gem::Requirement</string>
11+
</value>
12+
</member>
13+
</struct>
14+
</value>
15+
</param>
16+
</params>
17+
</methodResponse>

test/test_parser.rb

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,10 @@ def setup
2525
@datetime_xml = File.read(datafile('datetime_iso8601.xml'))
2626
@datetime_expected = XMLRPC::DateTime.new(2004, 11, 5, 1, 15, 23)
2727

28+
@marshallable_xml, @marshallable_expected = load_data('marshallable')
29+
2830
@fault_doc = File.read(datafile('fault.xml'))
31+
@marshallable = File.read(datafile('marshallable.xml'))
2932
end
3033

3134
# test parseMethodResponse --------------------------------------------------
@@ -50,6 +53,10 @@ def test_dateTime
5053
assert_equal(@datetime_expected, @p.parseMethodResponse(@datetime_xml)[1])
5154
end
5255

56+
def test_marshallable
57+
assert_equal(@marshallable_expected, @p.parseMethodResponse(@marshallable))
58+
end
59+
5360
# test parseMethodCall ------------------------------------------------------
5461

5562
def test_parseMethodCall

0 commit comments

Comments
 (0)