Workaround for CVE-2020-10663 (vulnerability in json gem)

The json gem has a security vulnerability CVE-2020-10663. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system.

Users are strongly advised to upgrade to json 2.3.0 or later.

For users who cannot upgrade their version of json, this gem (json_cve_2020_10663) monkey-patches your json version against against CVE-2020-10663.

Note that if you are using current version of Rails 3.2 LTS or 4.2 LTS, this gem is no longer required.

Requirements

• Ruby 1.8.7 or later
• json 1.7.7 or later, but earlier than 2.3.0.

Installation

Add this line to your application's Gemfile:

gem 'json_cve_2020_10663'

And then execute:

$ bundle

Or install it yourself as:

$ gem install json_cve_2020_10663

Require the gem to patch the json gem:

require 'json_cve_2020_10663'

Note that Rails automatically requires all gems in your Gemfile when your app is booted.

You can verify that the patch was applied by running the following code from your application environment:

JSON::GenericObject.json_creatable = true
JSON('{"json_class":"JSON::GenericObject"}').class

If this returns Hash, the patch was applied correctly. If it returns JSON::GenericObject, the patch was not loaded.

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

License

The gem is available as open source under the terms of the MIT License.