6 comments

  • Nextgrid 4 hours ago
    Doesn't this already require to be "on the other side of the airtight hatchway", or am I missing something?

    The Marshal.load docs explicitly have a warning that you should not pass it untrusted data: https://docs.ruby-lang.org/en/master/Marshal.html#module-mar...

    • Retr0id 4 hours ago
      Yes, but that doesn't mean defense-in-depth isn't worth doing. The article discusses how known gadgets were removed in the past.
  • sebiw 4 hours ago
    Which brings us to the old saying: Do not deserialize untrusted data.

    In the context of Rubygems and their specs this obviously is harder to manage but dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base.

    • sscaryterry 3 hours ago
      > dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base

      This mindset is changing, in the npm ecosystem, managing and updating dependencies have become somewhat of a gamble. It is no longer if, its when you are compromised.

      • jbverschoor 2 hours ago
        Gems/packages should explicitly declare what kind of features they need/want (file, net, deserialization, execute)

        And when the sig. changes, you should get a warning

        Very similar to the iOS entitlements

      • _joel 3 hours ago
        Checksumming the dependencies in the Gemfile may help. https://blog.rubygems.org/2024/12/19/bundler-v2-6.html
        • rjsw 18 minutes ago
          I have to use several gems that download and compile C sources from github at install time.
    • wyager 3 hours ago
      > Do not deserialize untrusted data.

      I think the better lesson is "use safe codecs"

    • ares623 2 hours ago
      LLMs: hold my beer
  • schwag09 56 minutes ago
    I wrote one of the referenced posts describing the history here: https://blog.trailofbits.com/2025/08/20/marshal-madness-a-br...

    I was also part of the team that audited RubyGems.org: https://github.com/trailofbits/publications/blob/master/revi...

    Look at TOB-RGM-9 (an informational, largely out-of-scope finding) if you want to understand what could be done to mitigate some of these concerns. Nearly all of these gadget chains rely on Gem library functionality, which has this wonky .gemspec.rz metadata file that sits alongside the actual gem file. I understand that it'd be a challenging, backwards-incompatible change, but moving this file from Marshal to JSON would break a lot of these gadget chains. Perhaps there would be others, but it would raise the bar.

  • mono442 3 hours ago
    Quoting the ruby documentation:

    > Marshal.load is not suitable as a general purpose serialization format and you should never unmarshal user supplied input or other untrusted data.

  • shevy-java 2 hours ago
    That's actually crafty. I wonder what the rationale was for the C function time_mload(). Anyone able to find out? How can we see which person created it first?
  • saadyousfi 3 hours ago
    [dead]