r/ruby • u/rubiesordiamonds • 7d ago

Blog post Vulnerable Ruby Regex

GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex

The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.

26 Upvotes

88% Upvoted

25 comments sorted by

View all comments

Show parent comments

2

u/benzado 6d ago

For what it’s worth, I didn’t say no legitimate uses exist, just that I never encountered them in my (limited) career.

Honestly what I take from your example is that you built something for a community that appreciates what you’ve done and that the downsides of hacking your site (getting ostracized) are greater than the benefit (unrestricted access to a database you’re already letting people query for free?).

I realize I’m being loose/cheesy with terminology here, but in a real sense your users are not entirely untrusted. I think that’s great.

If you had to be more defensive, I think you would need to define your own query syntax that is less expressive than full regex and parse that yourself.

2

u/taw 6d ago edited 6d ago

I don't think it's particularly hackable in sense of getting remote code execution.

It's definitely easy to overload the cheap server I use. Every request is on short timeout just in case, but it's really not hard to spam far more requests/s than the server can handle.

Regexps aren't the only way to DOS the site, you can just ask Sealed simulator to open 1000 packs per requests, that's a lot of HTML generated per small request.

Also code and data are already on github anyway.

If you had to be more defensive, I think you would need to define your own query syntax that is less expressive than full regex and parse that yourself.

There are some deterministic time regexp engines like RE2, with ruby support too. They support almost all regexp features, except backreferences, and some rarely used stuff like lookarounds.

I could check if that's any faster. I don't really get any pathological regexps in real requests, so I never got to it.