Stop json/plain from allocating arbitrary classes (0.0.7) - #359

Merged

d2army merged 12 commits into

transfers-masterfrom

ian-yap/secbugs-174-fail-closed-json-plain

Sep 3, 2026

Commits on Sep 3, 2026

Fail-closed json/plain deserialize against Oj object-mode gadgets.

d2army
and
cursoragent
committed
6d08d85
Pin protobuf 3 in CI and use docker compose v2.

d2army
and
cursoragent
committed
3bc84ca
Wait for Temporal on 7233 before example namespace registration.

d2army
and
cursoragent
committed
3fce4e5
Pin example Temporal images so CI can actually reach 7233.

d2army
and
cursoragent
committed
044ef47
Allow Temporal library types and anonymous Structs through json/plain.

d2army
and
cursoragent
committed
04efe37
Allow Thread::Backtrace through json/plain so raised errors round-trip.

d2army
and
cursoragent
committed
01a28b4
Reject duplicate JSON keys before Oj.load and restore odd-type round-trips.

d2army
and
cursoragent
committed
9f303f4
Harden json/plain deserialize against duplicate keys and deep nesting.

d2army
and
cursoragent
committed
423f197
Drop unvalidated key-length cap and extend duplicate-key specs.

d2army
and
cursoragent
committed
c187179
Trim redundant depth spec and duplicate protobuf Gemfile pins.

d2army
and
cursoragent
committed
834f3de
Clarify 0.0.7 changelog and reviewer comments on deserialize order.

d2army
and
cursoragent
committed
5ca889a
Add reviewer maps on json.rb and the other 0.0.7 diffs.

d2army
and
cursoragent
committed
58d40e5