Skip to content

Checking userinfo with the uri method#233

Merged
q9f merged 1 commit intomainfrom
fix-redos
May 8, 2023
Merged

Checking userinfo with the uri method#233
q9f merged 1 commit intomainfrom
fix-redos

Conversation

@kurotaky
Copy link
Contributor

@kurotaky kurotaky commented May 4, 2023

Fixed the basic auth decision in the http client so that it is not affected by ReDoS, which occurs in Ruby 3.1 and below.

close: https://github.com/q9f/eth.rb/security/code-scanning/10

Ruby 3.1.2

irb(main):001:0> RUBY_VERSION
=> "3.1.2"
irb(main):002:0> measure
TIME is added.
=> nil
irb(main):003:0>  /:.*@.*:/i =~ "https://example.com" * 1000
processing time: 0.069204s
=> nil
irb(main):004:0>  /:.*@.*:/i =~ "https://example.com" * 10000
processing time: 4.696144s
=> nil
irb(main):005:0>  /:.*@.*:/i =~ "https://example.com" * 50000
processing time: 119.181579s
=> nil

Ruby 3.2.0

irb(main):005:0> RUBY_VERSION
processing time: 0.000062s
=> "3.2.0"
irb(main):006:0> measure
processing time: 0.000090s
=> nil
irb(main):007:0>  /:.*@.*:/i =~ "https://example.com" * 1000
processing time: 0.001817s
=> nil
irb(main):008:0>  /:.*@.*:/i =~ "https://example.com" * 10000
processing time: 0.019022s
=> nil
irb(main):009:0>  /:.*@.*:/i =~ "https://example.com" * 100000
processing time: 0.101864s
=> nil

@codecov-commenter
Copy link

codecov-commenter commented May 4, 2023

Codecov Report

Merging #233 (b520064) into main (3c3c806) will not change coverage.
The diff coverage is 100.00%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@           Coverage Diff           @@
##             main     #233   +/-   ##
=======================================
  Coverage   99.66%   99.66%           
=======================================
  Files          77       77           
  Lines        4432     4432           
=======================================
  Hits         4417     4417           
  Misses         15       15
Impacted Files Coverage Δ
lib/eth/client/http.rb 100.00% <100.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@q9f q9f merged commit dcac24b into main May 8, 2023
@q9f q9f deleted the fix-redos branch May 8, 2023 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kurotaky @codecov-commenter @q9f