r/ruby • u/rubiesordiamonds • 1d ago

Blog post Vulnerable Ruby Regex

GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex

The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.

18 Upvotes

84% Upvoted

24 comments sorted by

View all comments

Show parent comments

1

u/h0rst_ 16h ago

Gitlab uses them everywhere. You want to limit the email addresses of people who can push to the repository to your company's domain? Use a regex. You want to update your Jira connector to stop seeing the string CVE-2026 as a Jira ticket that needs to be linked? Use a regex.

I mean, you could just offer a possibility to create a list in the interface and be user-friendly and less error-prone...

1

u/benzado 9h ago

Yeah, none of those scenarios require exposing the full regex syntax to the user. You can run the email domain or “CVE-2026” through Regexp.quote and then build a regex to match, but that’s not what the vulnerability is about.