Q
Detector Library
Ruby detectors (21/21)
SQL InjectionDivide by ZeroSensitive HTTP ActionInsufficient Protected CredentialsSensitive Information LeakUntrusted DeserializationLog InjectionXML External EntityPath InjectionHttp to File AccessCode InjectionOS Command InjectionResource leakCross Site Scripting (XSS)Untrusted OpenImproper Input ValidationStack Trace ExposureImproper Certificate Validationsend_file InjectionUnsafe File PermissionsTainted Format
Untrusted Deserialization High
Object deserialized from potentially dangerous source. This could overload a system with a denial of service attack, or execute remote code to control a system.
Detector ID
ruby/untrusted-deserialization@v1.0
Category
Common Weakness Enumeration (CWE) 
Tags
-
Noncompliant example
1def handler_noncompliant(event:, context:)
2 foobar = event['smth']
3 # Noncompliant: tainted data passed inside `CSV.load()`.
4 obj3 = CSV.load("o:" + event['data'])
5endCompliant example
1def handler_compliant(event:, context:)
2 # Compliant: no tainted data passed inside `CSV.load()`.
3 obj3 = CSV.load(get_safe_data())
4end