addressable 2.8.10 → 2.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 567262751c8952b3e982148b0759abfd535b3cb65b2693691b7bfc66ae529395
-  data.tar.gz: e097aecb9c501b7573412046a7df248b89dc73c9d3a1282010d640a79374a982
+  metadata.gz: ffaab8b78df30a2126058a425f168d76b26bc33e60849cabc1a6beabae24464d
+  data.tar.gz: 841ab2bd18fbcf3ff746cb85ea1661e628e278e6c7bc5ad96cd480e36a54f067
 SHA512:
-  metadata.gz: 84a81528fc62622ca0a384ce46495ffbc629700636b6751d7a0f128f3596d7419a8c797fc82059f97319e5e9a36f773d9ca49a0420b0e95aac693dc362ac26b6
-  data.tar.gz: 21aa9369e4eca88921f94d7d8785526b26e2b9bfbe8bc531a4e368f43c71e888ad0bb554190ec3a58a7d17a4ba4e5c5aedd3166a2bf68f58822b9b765de6c3f4
+  metadata.gz: f5884313cb2c68ea73d25e8f7f0a76200030bb3fb7abad8b31532180b1ae3c1df10f8db614a273dba115c87860682d227fdf046c743370e020a577cae667d026
+  data.tar.gz: c97dd91446991ce20400e9b4c2586aefbc1dca9fd1d49efca9606fc505ff0d49807686ab1fdfd7d4dba447c9c4bf8fb6c0bbd5a1d3d69a4952207d035e912dc2

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Addressable 2.9.0 <a name="v2.9.0">
+- fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete
+  remediation in 2.8.10)
+
 ## Addressable 2.8.10 <a name="v2.8.10">
 - fixes ReDoS vulnerability in Addressable::Template#match
 

data/lib/addressable/template.rb

@@ -987,7 +987,8 @@ module Addressable
         _, operator, varlist = *expansion.match(EXPRESSION)
         leader = Regexp.escape(LEADERS.fetch(operator, ''))
         joiner = Regexp.escape(JOINERS.fetch(operator, ','))
-        combined = varlist.split(',').map do |varspec|
+        varspecs = varlist.split(',')
+        combined = varspecs.map do |varspec|
           _, name, modifier = *varspec.match(VARSPEC)
 
           result = processor && processor.respond_to?(:match) ? processor.match(name) : nil
@@ -1017,7 +1018,11 @@ module Addressable
                     when '+', '#' then "#{RESERVED_NO_COMMA}*+"
                     else group
                     end
-              "(?<#{name}>#{seg}(?:#{joiner}?#{seg})*)?"
+              joiner_pattern = operator.nil? ? joiner : "#{joiner}?"
+              "(?<#{name}>#{seg}(?:#{joiner_pattern}#{seg})*)?"
+            elsif varspecs.size > 1 && (operator == '+' || operator == '#') &&
+                  varspec != varspecs.last
+              "(?<#{name}>#{RESERVED_NO_COMMA}*+)?"
             else
               "(?<#{name}>#{group})?"
             end

data/lib/addressable/version.rb

@@ -22,8 +22,8 @@ if !defined?(Addressable::VERSION)
   module Addressable
     module VERSION
       MAJOR = 2
-      MINOR = 8
-      TINY  = 10
+      MINOR = 9
+      TINY  = 0
 
       STRING = [MAJOR, MINOR, TINY].join('.')
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: addressable
 version: !ruby/object:Gem::Version
-  version: 2.8.10
+  version: 2.9.0
 platform: ruby
 authors:
 - Bob Aman
@@ -53,7 +53,7 @@ homepage: https://github.com/sporkmonger/addressable
 licenses:
 - Apache-2.0
 metadata:
-  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.8.10
+  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.0
 rdoc_options:
 - "--main"
 - README.md