Skip to content

Commit 2d0b054

Browse files
DevDev
authored andcommitted
Fixed the vulnerability issue
1 parent 37e183a commit 2d0b054

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

lib/money/bank/variable_exchange.rb

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,10 @@ def import_rates(format, s, opts = {})
265265
warn '[WARNING] Using :ruby format when importing rates is potentially unsafe and ' \
266266
'might lead to remote code execution via Marshal.load deserializer. Consider using ' \
267267
'safe alternatives such as :json and :yaml.'
268+
elsif format == :yaml
269+
warn '[WARNING] Using :yaml format when importing rates is potentially unsafe and ' \
270+
'might lead to remote code execution via Marshal.load deserializer. Consider using ' \
271+
'safe alternatives such as :json and :ruby.'
268272
end
269273

270274
store.transaction do

0 commit comments

Comments
 (0)