MultiJson 1.5.1 doesn´t allow to override create_additions about multi_json HOT 4 CLOSED

Try upgrading to 1.6.0.

from multi_json.

see this discussion here: flori/json#159

from multi_json.

Is there a distinction in between safe and unsafe methods for JSON deserialisation in MultiJson? The main problem with the recent security problems in Rails seems to be that there is no clear distinction between safe and unsafe interfaces to do this.

There are two major use cases why someone would want to deserialise something:

• Loading for example a configuration or a database record from a trusted source (can be unsafe),
• Parsing a message from a web client, etc., that is an untrusted source (should be very safe, that is prohibiting DOS attacks, injections, etc.).

The problem is how people can be directed to use the safe way when they don't bother thinking about the security implications, while still allowing people to do the unsafe things, if they really want to. The latter way should be cumbersome or deterrent enough, so the former group of people can never coincidentally stumble upon it.

from multi_json.

i think that there is no distinction in MultiJson for this purpose.

our problem is, that we use it talk to our "trusted" couchdb and handle object serialization while it also supports "untrusted" json requests from webclients...

nevertheless, i think that these security updates should manifest in minor or even mayor version updates.
jsongem fix version update from 1.7.6 to 1.7.7 breaks our whole app and there is no way of configuring it to work like before.

the same is true for OJ. MultiJson does not allow :compat mode, so deserialization is completele disabled:
https://github.com/intridea/multi_json/blob/master/lib/multi_json/adapters/oj.rb#L19

from multi_json.