File _service:tar_scm:CVE-2023-22799.patch of Package rubygem-globalid

File _service:tar_scm:CVE-2023-22799.patch of Package rubygem-globalid (Revision 66a60325e4ba91a6ef01492f77ca08e1)

Currently displaying revision 66a60325e4ba91a6ef01492f77ca08e1 , Show latest

From 3bc4349422e60f2235876a59dd415e98b072eb2b Mon Sep 17 00:00:00 2001
From: Aaron Patterson <tenderlove@ruby-lang.org>
Date: Tue, 17 Jan 2023 13:32:28 -0800
Subject: [PATCH] Fix ReDoS vulnerability in name parsing

Thanks to @ooooooo_q for the patch!

[CVE-2023-22799]
---
 lib/global_id/uri/gid.rb | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/lib/global_id/uri/gid.rb b/lib/global_id/uri/gid.rb
index f5d52dc..3fadf4f 100644
--- a/lib/global_id/uri/gid.rb
+++ b/lib/global_id/uri/gid.rb
@@ -127,9 +127,6 @@ def set_params(params)
     private
       COMPONENT = [ :scheme, :app, :model_name, :model_id, :params ].freeze
 
-      # Extracts model_name and model_id from the URI path.
-      PATH_REGEXP = %r(\A/([^/]+)/?([^/]+)?\z)
-
       def check_host(host)
         validate_component(host)
         super
@@ -149,11 +146,11 @@ def check_scheme(scheme)
       end
 
       def set_model_components(path, validate = false)
-        _, model_name, model_id = path.match(PATH_REGEXP).to_a
-        model_id = CGI.unescape(model_id) if model_id
-
+        _, model_name, model_id = path.split('/', 3)
         validate_component(model_name) && validate_model_id(model_id, model_name) if validate
 
+        model_id = CGI.unescape(model_id) if model_id
+
         @model_name = model_name
         @model_id = model_id
       end
@@ -166,7 +163,7 @@ def validate_component(component)
       end
 
       def validate_model_id(model_id, model_name)
-        return model_id unless model_id.blank?
+        return model_id unless model_id.blank? || model_id.include?('/')
 
         raise MissingModelIdError, "Unable to create a Global ID for " \
           "#{model_name} without a model id."