The interesting part is that these aren't custom deserialization hooks like marshal_load - hash, eql?, <=>, to_str, to_s, and respond_to? are ordinary methods every Ruby object already has, invoked automatically the moment the deserialized object gets compared, hashed, or coerced anywhere downstream. That's what makes it hard to harden away: you'd have to audit every place a deserialized object might end up in a Hash key, a case/when, or a string interpolation, not just look for classes that opt into deserialization callbacks.
1
u/Just_Worldliness_714 2d ago
The interesting part is that these aren't custom deserialization hooks like marshal_load - hash, eql?, <=>, to_str, to_s, and respond_to? are ordinary methods every Ruby object already has, invoked automatically the moment the deserialized object gets compared, hashed, or coerced anywhere downstream. That's what makes it hard to harden away: you'd have to audit every place a deserialized object might end up in a Hash key, a case/when, or a string interpolation, not just look for classes that opt into deserialization callbacks.