Ruby 4.0 Universal RCE Deserialization Gadget Chain

Doesn't this already require to be "on the other side of the airtight hatchway", or am I missing something?

The Marshal.load docs explicitly have a warning that you should not pass it untrusted data: https://docs.ruby-lang.org/en/master/Marshal.html#module-mar...

Which brings us to the old saying: Do not deserialize untrusted data.

In the context of Rubygems and their specs this obviously is harder to manage but dependencies such as Rubygems are and will always be part of your app's Trusted Computing Base.

That's actually crafty. I wonder what the rationale was for the C function time_mload(). Anyone able to find out? How can we see which person created it first?

Quoting the ruby documentation:

> Marshal.load is not suitable as a general purpose serialization format and you should never unmarshal user supplied input or other untrusted data.

[dead]