Collected research
Class Pollution in Ruby: A Deep Dive into Exploiting Recursive Merges
A recursive merge writing JSON keys onto object attributes via instance_variable_set lets attacker keys shadow methods: to_s set to Admin passes an authorisation check, and protected_methods set to a string reaches instance_eval. Because the walk follows respond_to? and public_send, keys like class.superclass.url escape the instance and poison class variables of parents and, via subclasses.sample, unrelated classes. Hashie's _ key returns a fresh Mash that sidesteps its method protection.
Record
- Researcher
- Raúl Miján
- Published by
- blog.doyensec.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Raúl Miján, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .