20 lines
822 B
Markdown
20 lines
822 B
Markdown
# Changelog
|
|
|
|
All notable changes to rube are documented here.
|
|
|
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## [Unreleased]
|
|
|
|
### Added
|
|
|
|
- Marshal stream parser that extracts structure, class names, and gadget sinks
|
|
from a serialized payload without ever calling `Marshal.load`
|
|
- Sink classification along the gated/ungated dispatch axis: `marshal_load` and
|
|
`_load` are reached through a `respond_to?` check, while `hash`, `eql?`, `<=>`
|
|
and `[]=` are dispatched blind
|
|
- Stream validation rejecting truncated payloads, unsupported version bytes,
|
|
unknown type tags, out-of-bounds object links and symlinks, oversized fixnum
|
|
widths, trailing bytes, and nesting beyond a configurable depth limit
|