Visitar URL original
fix ReDoS by ooooooo-q · Pull Request #600 · ruby-i18n/i18n · GitHub
Skip to content

fix ReDoS - #600

Merged
radar merged 1 commit into
ruby-i18n:masterfrom
ooooooo-q:master
Jan 26, 2022
Merged

radar merged 1 commit into
ruby-i18n:masterfrom
ooooooo-q:master

Conversation

@ooooooo-q

@ooooooo-q ooooooo-q commented Jan 10, 2022 •

Copy link
Copy Markdown
Contributor

In the process of investigating Rails regular expressions using Regexploit, I discovered that i18n sometimes had ReDoS problems.
ReDoS seems to occur when there is a code like below.

I18n.interpolate('%<0>' + '0' * 3456, :num => 1)

The problem occurs when there is a translation file like the one below, but it seems that there are few cases where an attacker can inject on it.

en:
  test: "%<0>000..." # 0 * 3456

Results of Regexploit

(?-mix:%%)|(?-mix:%\{([\w|]+)\})|(?-mix:%<(\w+)>(.*?\d*\.?\d*[bBdiouxXeEfgGcps]))
Pattern: (?-mix:%%)|(?-mix:%\{([\w|]+)\})|(?-mix:%<(\w+)>(.*?\d*\.?\d*[bBdiouxXeEfgGcps]))
---
Redos(starriness=3, prefix_sequence=SEQ{ [25:%] [3c:<] [WORD]{1+} [3e:>] }, redos_sequence=SEQ{ .{0+} [DIGIT]{0+} [2e:.]{0,1} [DIGIT]{0+} [B,E,G,i,o,p,s,u,X,x,[b-g]] }, repeated_character=[DIGIT], killer=None)
Worst-case complexity: 3 ⭐⭐⭐ (cubic)
Repeated character: [DIGIT]
Example: '%<0>' + '0' * 3456


(?-mix:%%)|(?-mix:%\{([\w|]+)\})|(?-mix:%<(\w+)>([^\d]*?\d*\.?\d*[bBdiouxXeEfgGcps]))
No ReDoS found.

@radar
radar merged commit d763372 into ruby-i18n:master Jan 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants