[ruby-core:113254] [Ruby master Feature#19528] `JSON.load` defaults are surprising (`create_additions: true`)
From:
"mame (Yusuke Endoh) via ruby-core" <ruby-core@...>
Date:
2023-04-14 14:16:19 UTC
List:
ruby-core #113254
Issue #19528 has been updated by mame (Yusuke Endoh).
Eregon (Benoit Daloze) wrote in #note-4:
> Maybe we could warn only if object deserialization is actually used?
This idea came up at the dev meeting, but if we change it to safe by default in the future, it will not be a migration path.
In any case, I think this should be discussed at https://github.com/flori/json.
----------------------------------------
Feature #19528: `JSON.load` defaults are surprising (`create_additions: true`)
https://bugs.ruby-lang.org/issues/19528#change-102810
* Author: byroot (Jean Boussier)
* Status: Open
* Priority: Normal
----------------------------------------
I'm not sure if it was actually intended, but there's some tacit naming convention for serializers in Ruby to use `load` and `dump` as methods, likely inspired from `Marshal` and `YAML`.
Because of this it's extremely common to see code that uses `JSON.load` expecting a simple, no surprise, and safe JSON parsing.
However that's `JSON.parse`.
`JSON.load` has this very surprising behavior (albeit perfectly documented), of de-serializing more complex types:
```ruby
>> JSON.load('{ "json_class": "String", "raw": [72, 101, 108, 108, 111] }')
=> "Hello"
```
It's particularly weird because aside from the `String` extension that is eagerly defined, for other types you have to `require "json/add/core"`.
Seasoned Ruby developers know about this of course, and [it is banned by various linters](https://www.rubydoc.info/gems/rubocop/RuboCop/Cop/Security/JSONLoad), but it keeps popping regularly in [gems security releases](https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467) and such.
### Proposal
Assuming entirely removing this feature is not an option, I think `json 2.x` should warn when this feature is actually being used, and `json 3.x` should disable it by default and require users to explicitly use `JSON.load(str, create_additions: true)` to keep the old behavior.
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- [email protected]
To unsubscribe send an email to [email protected]
ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/