Heroku潜在的安全漏洞在Ruby和YAML解析命令行检查中

Question

我收到了这封Heroku漏洞邮件:

https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525/?mkt_tok=3RkMMJWWfF9wsRonuKjAZKXonjHpfsX%2B6u8vXaO%2FlMI %2F0ER3fOvrPUfGjI4ASsNjI%2BSLDwEYGJlv6SgFQrjAMapmyLgLUhE%3D

在电子邮件中,它说:

检查您是否受到影响

在您的应用上运行以下内容:

 $ heroku run “ruby -rpsych -e \”p Psych.libyaml_version.join(‘.’)\”” -a <app name>

如果您看到以下错误消息,那么您不容易受到攻击,可以忽略此电子邮件的其余部分:

  <internal:lib/rubygems/custom_require>:29:in `require': no such file to load -- psych (LoadError)
  from <internal:lib/rubygems/custom_require>:29:in `require'

不幸的是,当我运行它时,出现了错误(使用Mac):

 -bash: syntax error near unexpected token `('

如何正确运行上面的命令行？谢谢.

Answer 1

$ heroku run “ruby -rpsych -e \”p Psych.libyaml_version.join(‘.’)\”” -a <app name>

有左右手引号:”和’

将这些更改为初学者的直引号:"和'