Description

This detector identifies dangerous use of Ruby's Marshal class for deserialization operations. Marshal.load() and similar methods can execute arbitrary code when deserializing untrusted data, leading to remote code execution vulnerabilities.

Detection Strategy

• Scans Ruby source code files (excluding test files) for method calls on the Marshal class

• Identifies calls to dangerous Marshal methods like 'load', 'restore', or other deserialization operations

• Checks if the first argument to the Marshal method comes from an unsafe source (user input, external data, etc.)

• Reports a vulnerability when Marshal deserialization methods are called with potentially untrusted data that hasn't been properly sanitized

Vulnerable code example

require 'base64'

class RestoreController < ApplicationController
  def case_1
    Marshal.load(params[:state]) # Direct deserialization of user input - RCE risk
  end

  def case_2...

✅ Secure code example

require 'base64'
require 'json'

class RestoreController < ApplicationController
  def case_1
    JSON.parse(params[:state]) # Use JSON instead of Marshal for user input
  end
...