Workaround for CVE-2020-10663 (vulnerability in json gem)

The json gem has a security vulnerability CVE-2020-10663. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system.

Users are strongly advised to upgrade to json 2.3.0 or later.

For users who cannot upgrade their version of json, this gem (json_cve_2020_10663) monkey-patches your json version against against CVE-2020-10663.

Installation

Add this line to your application's Gemfile:

gem 'json_cve_2020_10663'

And then execute:

$ bundle

Or install it yourself as:

$ gem install json_cve_2020_10663

Usage

This gem monkey patches the json gem when it is required:

require 'json_cve_2020_10663'

Note that Rails automatically requires all gems in your Gemfile when your app is booted.

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

License

The gem is available as open source under the terms of the MIT License.