path: root/doc
diff options
authormarcandre <marcandre@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2015-02-05 20:06:11 (GMT)
committermarcandre <marcandre@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2015-02-05 20:06:11 (GMT)
commit899a1faa8f27d7ff26d3766b47b47d118813da5d (patch)
tree14e4d3338375f97fc4e1983a5482a2ae9e1cfce2 /doc
parent9dc51967ef97808eacc2a900742a16aac2bd090b (diff)
* doc/security.rdoc: [DOC] ammend symbols section for bug with
keyword args [ci-skip] git-svn-id: svn+ssh:// b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'doc')
1 files changed, 3 insertions, 2 deletions
diff --git a/doc/security.rdoc b/doc/security.rdoc
index 5fb7b15..2a610f1 100644
--- a/doc/security.rdoc
+++ b/doc/security.rdoc
@@ -75,9 +75,10 @@ They are created when modifying code:
* defining a method (e.g. with +define_method+),
* setting an instance variable (e.g. with +instance_variable_set+),
* creating a variable or constant (e.g. with +const_set+)
-Because of a bug, +send+ and +__send__+ also create immortal symbols.
-Finally, C extensions that have not been updated and are still calling `ID2SYM`
+C extensions that have not been updated and are still calling `ID2SYM`
will create immortal symbols.
+Bugs in 2.2.0: +send+ and +__send__+ also created immortal symbols,
+and calling methods with keyword arguments could also create some.
Don't create immortal symbols from user inputs. Otherwise, this would
allow a user to mount a denial of service attack against your application by