From 3bc4349422e60f2235876a59dd415e98b072eb2b Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Tue, 17 Jan 2023 13:32:28 -0800 Subject: [PATCH] Fix ReDoS vulnerability in name parsing Thanks to @ooooooo_q for the patch! [CVE-2023-22799] --- lib/global_id/uri/gid.rb | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/lib/global_id/uri/gid.rb b/lib/global_id/uri/gid.rb index f5d52dc..3fadf4f 100644 --- a/lib/global_id/uri/gid.rb +++ b/lib/global_id/uri/gid.rb @@ -127,9 +127,6 @@ def set_params(params) private COMPONENT = [ :scheme, :app, :model_name, :model_id, :params ].freeze - # Extracts model_name and model_id from the URI path. - PATH_REGEXP = %r(\A/([^/]+)/?([^/]+)?\z) - def check_host(host) validate_component(host) super @@ -149,11 +146,11 @@ def check_scheme(scheme) end def set_model_components(path, validate = false) - _, model_name, model_id = path.match(PATH_REGEXP).to_a - model_id = CGI.unescape(model_id) if model_id - + _, model_name, model_id = path.split('/', 3) validate_component(model_name) && validate_model_id(model_id, model_name) if validate + model_id = CGI.unescape(model_id) if model_id + @model_name = model_name @model_id = model_id end @@ -166,7 +163,7 @@ def validate_component(component) end def validate_model_id(model_id, model_name) - return model_id unless model_id.blank? + return model_id unless model_id.blank? || model_id.include?('/') raise MissingModelIdError, "Unable to create a Global ID for " \ "#{model_name} without a model id."