Fix ReDoS vulnerability in StringUtils#underscore

## Summary

Replace regex patterns with lookahead/lookbehind assertions to prevent
catastrophic backtracking on Ruby 3.1 and earlier.

This issue only affects Ruby 3.1 and earlier. Since it does not occur on Ruby 3.2+,
it is not an issue in the current stable release (0.4.0), which does not include #206.

## Regression Testing

Ensure the regex patterns complete within 1 second for a 50,000-character input
that would otherwise trigger superlinear backtracking.
This commit is contained in:
Koichi ITO 2026-01-09 01:14:52 +09:00
commit 248b4d2dad

View file

@ -16,8 +16,8 @@ module MCP
def underscore(camel_cased_word)
camel_cased_word
.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
.gsub(/([a-z\d])([A-Z])/, '\1_\2')
.gsub(/(?<=[A-Z])(?=[A-Z][a-z])/, "_")
.gsub(/(?<=[a-z\d])(?=[A-Z])/, "_")
.tr("-", "_")
.downcase
end