Fix ReDoS vulnerability in StringUtils#underscore
## Summary Replace regex patterns with lookahead/lookbehind assertions to prevent catastrophic backtracking on Ruby 3.1 and earlier. This issue only affects Ruby 3.1 and earlier. Since it does not occur on Ruby 3.2+, it is not an issue in the current stable release (0.4.0), which does not include #206. ## Regression Testing Ensure the regex patterns complete within 1 second for a 50,000-character input that would otherwise trigger superlinear backtracking.
This commit is contained in:
parent
b92dbe4c28
commit
248b4d2dad
1 changed files with 16 additions and 2 deletions
|
|
@ -16,8 +16,8 @@ module MCP
|
|||
|
||||
def underscore(camel_cased_word)
|
||||
camel_cased_word
|
||||
.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
|
||||
.gsub(/([a-z\d])([A-Z])/, '\1_\2')
|
||||
.gsub(/(?<=[A-Z])(?=[A-Z][a-z])/, "_")
|
||||
.gsub(/(?<=[a-z\d])(?=[A-Z])/, "_")
|
||||
.tr("-", "_")
|
||||
.downcase
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in a new issue