Class: MetasploitDataModels::YAML
- Inherits:
-
Object
- Object
- MetasploitDataModels::YAML
- Defined in:
- lib/metasploit_data_models/yaml.rb
Overview
Namespace for YAML configuration
Constant Summary collapse
- PERMITTED_CLASSES =
List of supported classes when deserializing YAML classes See: https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
[ Range, Set, Symbol, Time, 'WEBrick::Cookie'.to_sym, 'ActionController::Parameters'.to_sym, 'ActiveModel::Attribute::FromDatabase'.to_sym, 'ActiveModel::Attribute::FromUser'.to_sym, 'ActiveModel::Attribute::WithCastValue'.to_sym, 'ActiveModel::Type::Boolean'.to_sym, 'ActiveModel::Type::Integer'.to_sym, 'ActiveModel::Type::String'.to_sym, 'ActiveRecord::Coders::JSON'.to_sym, 'ActiveSupport::TimeWithZone'.to_sym, 'ActiveSupport::TimeZone'.to_sym, 'ActiveRecord::Type::Serialized'.to_sym, 'ActiveRecord::Type::Text'.to_sym, 'ActiveSupport::HashWithIndifferentAccess'.to_sym, 'Mdm::Workspace'.to_sym ].freeze