# Networked Marshal Questions

**URL:** <https://www.ruby-forum.com/t/networked-marshal-questions/123533>\
**Category:** Ruby\
**Created:** [December 18, 2007, 2:25pm UTC](https://www.ruby-forum.com/t/networked-marshal-questions/123533 "2007-12-18T14:25:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![polypus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b5ac83/32.png) [@polypus](https://www.ruby-forum.com/u/polypus)\
**Post date:** [December 18, 2007, 2:25pm UTC](https://www.ruby-forum.com/t/networked-marshal-questions/123533/1 "2007-12-18T14:25:33Z")

</div>

hi all,

what are the security implications of dumping/loading marshalled objects  
over the network if any?

if i marshal a float or an array of floats, am i guaranteed to have the  
same exact floating point value upon load, on a different machine? does  
this depend on ieee float compliance?

thanks,  
\_c

---

<div class="post-metadata">

**Author:** ![polypus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b5ac83/32.png) [@polypus](https://www.ruby-forum.com/u/polypus)\
**Post date:** [December 18, 2007, 4:57pm UTC](https://www.ruby-forum.com/t/networked-marshal-questions/123533/2 "2007-12-18T16:57:58Z")

</div>

2007/12/18, Christophe M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> what are the security implications of dumping/loading marshalled objects  
> over the network if any?

If the connection is not encrypted anybody can sniff the traffic and  
probably also reconstruct marshalled objects.

> if i marshal a float or an array of floats, am i guaranteed to have the  
> same exact floating point value upon load, on a different machine? does  
> this depend on ieee float compliance?

My gut guess would be that there is no dependency on platforms -  
otherwise the feature would not make much sense. If nobody gives you  
a definitive answer here you can either look at the sources or try it  
out for yourself.

Kind regards

robert

---

<div class="post-metadata">

**Author:** ![polypus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b5ac83/32.png) [@polypus](https://www.ruby-forum.com/u/polypus)\
**Post date:** [December 18, 2007, 5:08pm UTC](https://www.ruby-forum.com/t/networked-marshal-questions/123533/3 "2007-12-18T17:08:43Z")

</div>

> If the connection is not encrypted anybody can sniff the traffic and  
> probably also reconstruct marshalled objects.

thanks for the reply. i was thinking more along the lines of execution  
security, as in `rm -fr /`.

some malicious class could do damage if instantiated through  
marshaling, but then it would already have to exist in the running  
executable, so at first glance it seems there is no danger, but just  
thought  
i’d ask anyway.

\_c

---

<div class="post-metadata">

**Author:** ![polypus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b5ac83/32.png) [@polypus](https://www.ruby-forum.com/u/polypus)\
**Post date:** [December 18, 2007, 5:44pm UTC](https://www.ruby-forum.com/t/networked-marshal-questions/123533/4 "2007-12-18T17:44:21Z")

</div>

On Dec 18, 2007 9:11 AM, Christophe M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> marshaling, but then it would already have to exist in the running  
> executable, so at first glance it seems there is no danger, but just  
> thought  
> i’d ask anyway.

You can set the $SAFE level of a ruby script.

[http://phrogz.net/ProgrammingRuby/taint.html](http://phrogz.net/ProgrammingRuby/taint.html)

Any strings that come in from userland (stdin, sockets, pipes, etc.)  
are tainted by default. When you set a higher safe level, ruby  
restricts what can be done with those tainted strings. Read the link  
above – it’s a chapter from the Programming Ruby book (the pick-axe)  
– and it goes into much more detail than I could ever hope to type  
here.

Blessings,  
TwP