Skip to content

Fix public send code execution vulnerability

bohdan-barylo requested to merge 374613-fix-public-send-vulnerability into master

What does this MR do and why?

Fix public send code execution vulnerability. The problem stays in using public_send function that can be used for code execution. Here I've changed it to method_missing function that is actually used by Nokogiri gem for creating tags dynamically behind the scene. https://www.rubydoc.info/github/sparklemotion/nokogiri/Nokogiri%2FXML%2FBuilder:method_missing

Screenshots or screen recordings

Screenshot_2022-09-26_at_23.08.28

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #374613 (closed)

Edited by bohdan-barylo

Merge request reports