Suggestion: Disable ENABLE_MARSHALLING by default

Given the plethora of cases about possible RCE vulnerabilities that have led to the 0.3.3 release, I would like to argue that the default object marshalling is incorrect.

Beside the security related issues, there is also the issue that XML-RPC is a language agnostic protocol, and the Ruby object marshalling is a Ruby only extension. It would not make any sense to serialize a Ruby object when the server is running Perl, Python or any other language that is not Ruby. The other XML-RPC extensions (8 byte integers, nil serialization, nil deserialization) are disabled by default as well.

Of course, I might be totally wrong here. Are there any people who actually use the object serialization of this gem?

Beginnen Sie damit, ENABLE_MARSHALLING zu lokalisieren und dessen standardmäßige Behandlung mit den anderen im Issue erwähnten XML-RPC-Erweiterungen zu vergleichen. Prüfen Sie, ob bestehende Benutzer auf die Serialisierung von Ruby-Objekten angewiesen sind, und bestimmen Sie, welche Tests oder Dokumentation die Änderung des Standards als vollständig definieren würden.