Skip to content

Commit 1cabc66

Browse files
DevDev
authored andcommitted
Fixed vulnerability issue
1 parent 37e183a commit 1cabc66

File tree

1 file changed

+0
-20
lines changed

1 file changed

+0
-20
lines changed

lib/money/bank/variable_exchange.rb

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -258,26 +258,6 @@ def rates
258258
#
259259
# bank.get_rate("USD", "CAD") #=> 1.24515
260260
# bank.get_rate("CAD", "USD") #=> 0.803115
261-
def import_rates(format, s, opts = {})
262-
raise Money::Bank::UnknownRateFormat unless RATE_FORMATS.include?(format)
263-
264-
if format == :ruby
265-
warn '[WARNING] Using :ruby format when importing rates is potentially unsafe and ' \
266-
'might lead to remote code execution via Marshal.load deserializer. Consider using ' \
267-
'safe alternatives such as :json and :yaml.'
268-
end
269-
270-
store.transaction do
271-
data = FORMAT_SERIALIZERS[format].load(s)
272-
273-
data.each do |key, rate|
274-
from, to = key.split(SERIALIZER_SEPARATOR)
275-
store.add_rate from, to, rate
276-
end
277-
end
278-
279-
self
280-
end
281261
end
282262
end
283263
end

0 commit comments

Comments
 (0)