# File lib/brakeman/checks/check_yaml_parsing.rb, line 8
  def run_check
    return unless version_between? "0.0.0", "2.3.14" or
                  version_between? "3.0.0", "3.0.18" or
                  version_between? "3.1.0", "3.1.9" or
                  version_between? "3.2.0", "3.2.10"

    unless disabled_xml_parser? or disabled_xml_dangerous_types?
      new_version = if version_between? "0.0.0", "2.3.14"
                      "2.3.15"
                    elsif version_between? "3.0.0", "3.0.18"
                      "3.0.19"
                    elsif version_between? "3.1.0", "3.1.9"
                      "3.1.10"
                    elsif version_between? "3.2.0", "3.2.10"
                      "3.2.11"
                    end

      message = msg(msg_version(rails_version), " has a remote code execution vulnerability. Upgrade to ", msg_version(new_version), " or disable XML parsing")

      warn :warning_type => "Remote Code Execution",
        :warning_code => :CVE_2013_0156,
        :message => message,
        :confidence => :high,
        :gem_info => gemfile_or_environment,
        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/61bkgvnSGTQ/discussion"
    end

    #Warn if app accepts YAML
    if version_between?("0.0.0", "2.3.14") and enabled_yaml_parser?
      message = "Parsing YAML request parameters enables remote code execution: disable YAML parser"

      warn :warning_type => "Remote Code Execution",
        :warning_code => :CVE_2013_0156,
        :message => message,
        :confidence => :high,
        :gem_info => gemfile_or_environment,
        :link_path => "https://groups.google.com/d/topic/rubyonrails-security/61bkgvnSGTQ/discussion"
    end
  end