Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Checking userinfo with the uri method #233

Merged
merged 1 commit into from
May 8, 2023
Merged

Checking userinfo with the uri method #233

merged 1 commit into from
May 8, 2023

Conversation

kurotaky
Copy link
Collaborator

@kurotaky kurotaky commented May 4, 2023

Fixed the basic auth decision in the http client so that it is not affected by ReDoS, which occurs in Ruby 3.1 and below.

close: https://github.com/q9f/eth.rb/security/code-scanning/10

Ruby 3.1.2

irb(main):001:0> RUBY_VERSION
=> "3.1.2"
irb(main):002:0> measure
TIME is added.
=> nil
irb(main):003:0>  /:.*@.*:/i =~ "https://example.com" * 1000
processing time: 0.069204s
=> nil
irb(main):004:0>  /:.*@.*:/i =~ "https://example.com" * 10000
processing time: 4.696144s
=> nil
irb(main):005:0>  /:.*@.*:/i =~ "https://example.com" * 50000
processing time: 119.181579s
=> nil

Ruby 3.2.0

irb(main):005:0> RUBY_VERSION
processing time: 0.000062s
=> "3.2.0"
irb(main):006:0> measure
processing time: 0.000090s
=> nil
irb(main):007:0>  /:.*@.*:/i =~ "https://example.com" * 1000
processing time: 0.001817s
=> nil
irb(main):008:0>  /:.*@.*:/i =~ "https://example.com" * 10000
processing time: 0.019022s
=> nil
irb(main):009:0>  /:.*@.*:/i =~ "https://example.com" * 100000
processing time: 0.101864s
=> nil

@codecov-commenter
Copy link

Codecov Report

Merging #233 (b520064) into main (3c3c806) will not change coverage.
The diff coverage is 100.00%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@           Coverage Diff           @@
##             main     #233   +/-   ##
=======================================
  Coverage   99.66%   99.66%           
=======================================
  Files          77       77           
  Lines        4432     4432           
=======================================
  Hits         4417     4417           
  Misses         15       15           
Impacted Files Coverage Δ
lib/eth/client/http.rb 100.00% <100.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@q9f q9f merged commit dcac24b into main May 8, 2023
@q9f q9f deleted the fix-redos branch May 8, 2023 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants