Skip to content

Commit

Permalink
Remove object from the available list of FLUENT_OJ_OPTION_MODE
Browse files Browse the repository at this point in the history
There is less benefit by this option in actual, and it will instroduce
serious security risk since it can execute arbitrary Ruby code.
We remove it since keeping it secure is difficult.

ref: GHSL-2022-067

Signed-off-by: Takuro Ashie <ashie@clear-code.com>
  • Loading branch information
ashie committed Oct 27, 2022
1 parent d005002 commit 48e5b85
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/fluent/oj_options.rb
Expand Up @@ -11,7 +11,7 @@ class OjOptions

ALLOWED_VALUES = {
'bigdecimal_load': %i[bigdecimal float auto],
'mode': %i[strict null compat json rails object custom]
'mode': %i[strict null compat json rails custom]
}

DEFAULTS = {
Expand Down

0 comments on commit 48e5b85

Please sign in to comment.