Cybersecurity-Projects/PROJECTS/beginner/deserialization-gadget-lab/CHANGELOG.md

20 lines
822 B
Markdown

# Changelog
All notable changes to rube are documented here.
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
### Added
- Marshal stream parser that extracts structure, class names, and gadget sinks
from a serialized payload without ever calling `Marshal.load`
- Sink classification along the gated/ungated dispatch axis: `marshal_load` and
`_load` are reached through a `respond_to?` check, while `hash`, `eql?`, `<=>`
and `[]=` are dispatched blind
- Stream validation rejecting truncated payloads, unsupported version bytes,
unknown type tags, out-of-bounds object links and symlinks, oversized fixnum
widths, trailing bytes, and nesting beyond a configurable depth limit