I don't use Rails, and read up on the vulnerabilities. Here's a quick summary:<p>1. This class of problems is not unique to Ruby.<p>2. Similar problems have been identified in Struts, and python's pickle.<p>3. Specifically in this case, YAML.load() can deserialize unintended object types. In the case of Struts the problem was the expression library used can also deserialize unintended object types (like File), plus setting properties on these types can have side effects (such as dropping files into your system).<p>4. I took a look at Microsoft's WCF. The DataContractSerializer states that it only is allowed to load types that are specified by a contract. <a href="http://msdn.microsoft.com/en-us/library/vstudio/ms733135(v=vs.90).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/vstudio/ms733135(v=v...</a> This should be the gold standard. In addition, it warns that even loading XML documents can be dangerous if we then load remote DTDs for validation.<p>5. For the old salts, remoting or RMI have similar issues - both mitigated by restricting the types that can be deserialized. <a href="http://msdn.microsoft.com/en-us/library/5dxse167(v=vs.71).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/5dxse167(v=vs.71).as...</a><p>6. Here's another vulnerability which targets serialization <a href="http://wouter.coekaerts.be/2011/spring-vulnerabilities" rel="nofollow">http://wouter.coekaerts.be/2011/spring-vulnerabilities</a><p>In summary,<p>1. all deserializers should be viewed with suspicion.<p>2. A deserializer which does not implement a whitelist of types that it can deserialize to is not suited for handling arbitrary data.<p>3. For example, it is capable to creating untainted/trusted objects in application servers, which some time later, may be used for XSS, or execution in SQL. In the Struts case, the standard Java libraries have constructors and methods that deserializing is enough to result in an arbitrary file being dropped on the remote file system.