Making Open Source Safer for Everyone with Shopify’s Bug Bounty Program - Shopify

What this post added

This post details a specific contribution to the Rails library inspired by a bug bounty report. It describes how a deserialization vulnerability in Rails' MessageEncryptor and MessageVerifier, which defaulted to using the unsafe Marshal serializer, was identified. The post explains the fix implemented in Shopify's internal systems (switching to JSON serializer) and the subsequent contribution to Rails to change the default serializer to JSON for MessageEncryptor and MessageVerifier in versions 7.1.X and beyond. It also provides a patch for Ruby applications to track and deprecate the use of Marshal.