The initial bug in Ruby&#x2F;Rails is striking in its stupidity.[1]  You can send something to Ruby&#x2F;Rails in a session cookie which, when unmarshalled, stores into <i>any named global variable in the namespace of the responding program</i>.  It&#x27;s not a buffer overflow or a bug like that.  It&#x27;s <i>deliberately designed to work that way</i>.  It&#x27;s like doing &quot;eval&quot; on untrusted input.  This was on YC years ago.[2]  Why was anything so idiotic ever put in Ruby at all?<p>Something like this makes you suspect a deliberate backdoor.  Can the person who put this into Ruby&#x2F;Rails be identified?<p>[1] <a href="http:&#x2F;&#x2F;robertheaton.com&#x2F;2013&#x2F;07&#x2F;22&#x2F;how-to-hack-a-rails-app-using-its-secret-token&#x2F;" rel="nofollow">http:&#x2F;&#x2F;robertheaton.com&#x2F;2013&#x2F;07&#x2F;22&#x2F;how-to-hack-a-rails-app-u...</a>
[2] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6110386" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6110386</a>