ruby-sdk/lib/mcp/string_utils.rb
Koichi ITO 248b4d2dad Fix ReDoS vulnerability in StringUtils#underscore
## Summary

Replace regex patterns with lookahead/lookbehind assertions to prevent
catastrophic backtracking on Ruby 3.1 and earlier.

This issue only affects Ruby 3.1 and earlier. Since it does not occur on Ruby 3.2+,
it is not an issue in the current stable release (0.4.0), which does not include #206.

## Regression Testing

Ensure the regex patterns complete within 1 second for a 50,000-character input
that would otherwise trigger superlinear backtracking.
2026-01-09 01:14:52 +09:00

25 lines
475 B
Ruby

# frozen_string_literal: true
module MCP
module StringUtils
extend self
def handle_from_class_name(class_name)
underscore(demodulize(class_name))
end
private
def demodulize(path)
path.to_s.split("::").last || path.to_s
end
def underscore(camel_cased_word)
camel_cased_word
.gsub(/(?<=[A-Z])(?=[A-Z][a-z])/, "_")
.gsub(/(?<=[a-z\d])(?=[A-Z])/, "_")
.tr("-", "_")
.downcase
end
end
end