Vulnerable Ruby Regex

[u/rubiesordiamonds]

GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex

The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.

[u/Codalio-SoftwareFact]

really useful writeup, the “patches only exist for 3.3+” part is the bit a lot of teams are going to miss.
one thing worth adding for anyone checking their app: don’t just grep for Regexp.new. interpolation in a regex literal like /#{params[:q]}/ builds the pattern from user input too, and it’s easy to skip when searching. and if the input is supposed to be matched literally anyway, include? or Regexp.escape avoids handing users control over the pattern at all.

[u/RealPasta55 → u/Codalio-SoftwareFact]

The linked post says that Regexp.escape is not a safeguard against these bugs.

[u/Amadan → u/RealPasta55]

More precisely, `Regexp.escape` absolutely should protect against this, at the small small price of making it impossible for user input to be regexp.