addressable 2.8.10 → 2.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 567262751c8952b3e982148b0759abfd535b3cb65b2693691b7bfc66ae529395
-  data.tar.gz: e097aecb9c501b7573412046a7df248b89dc73c9d3a1282010d640a79374a982
+  metadata.gz: a6d91298f649477b2a758f6205bd3598d071f8c6ee6c063e6a906833d7b1c22d
+  data.tar.gz: '0911936040e27dda609f926393afbd2b5791ec217e25abd02cb744d512e6cf32'
 SHA512:
-  metadata.gz: 84a81528fc62622ca0a384ce46495ffbc629700636b6751d7a0f128f3596d7419a8c797fc82059f97319e5e9a36f773d9ca49a0420b0e95aac693dc362ac26b6
-  data.tar.gz: 21aa9369e4eca88921f94d7d8785526b26e2b9bfbe8bc531a4e368f43c71e888ad0bb554190ec3a58a7d17a4ba4e5c5aedd3166a2bf68f58822b9b765de6c3f4
+  metadata.gz: 82bc575aff52883ab8834cd6e588db9e086f9721ef86dc93a43120ac4ae7b3ea88da1d74c05ca1f96ad3890854152f363acf02064c2a754dcd02101f5b509b90
+  data.tar.gz: f5da7b05d4d49ed517a5e3773adbb3146069492e69ee6666285fc9f298925b2805227003489abb5ee353270f23197c165e1b4c6d5b5588d03f887a5a44f4822b

data/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## Addressable 2.9.1 <a name="v2.9.1">
+- fixes denial of service in `Addressable::URI.normalize_path`, which took
+  quadratic time on paths with many dot segments; `URI#normalize`, `#join`,
+  `#==` and `#===` were affected (GHSA-qq38-m9mg-xjj5)
+- fixes `Addressable::URI.normalize_path` keeping segments that a `..` should
+  have removed after a `..` above the root, e.g.
+  `/../../public/x/../../secret` normalized to `/public/x/secret` instead of
+  `/secret` (GHSA-8gmh-2hhj-2hv9)
+- fixes `Addressable::URI.normalize_path` treating a raw line feed as a
+  segment boundary, e.g. joining `..\n/secret` onto `/public/` gave
+  `/\n/secret`
+- deprecates `Addressable::URI::RULE_2A`, `RULE_2B_2C`, `RULE_2D` and
+  `RULE_PREFIXED_PARENT`, which are no longer used; they will be removed in
+  2.10.0
+- fixes denial of service in `Addressable::Template#match` and `#extract`,
+  which still backtracked exponentially in 2.9.0 for exploded `/`, `.`, `;`,
+  `?` and `&` expressions (e.g. `{/path*}`) on regex engines without match
+  memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results
+  are unchanged (GHSA-j82w-28jv-3pmj)
+- fixes denial of service in `Addressable::Template#match` and `#extract`,
+  which backtracked polynomially or exponentially on the same regex engines
+  for expressions with several variables (e.g. `{/owner,repo,ref}`, or
+  `{+a,b,c}` with many variables), for `;` expressions, and for adjacent
+  expressions (e.g. `{+a}{+b}{+c}` or `{+a}{b}`); match results are unchanged
+  (GHSA-9f42-57jx-vpp3)
+- fixes denial of service in `Addressable::Template#match` and `#extract`,
+  which backtracked polynomially for expressions with several exploded
+  variables (e.g. `{+a*,b*}`), including on MRI 3.2; match results are
+  unchanged (GHSA-4w5q-wg7v-w6gp)
+- fixes `Addressable::IDNA.to_unicode` in the pure-Ruby backend decoding
+  Punycode labels that aren't valid A-labels: labels that decode to only
+  ASCII characters (e.g. `xn--google-` decoded to `google`) and labels that
+  don't convert back to themselves; such a label is now returned unchanged,
+  as with libidn, so `Addressable::URI#display_uri` no longer shows a host
+  that differs from `#normalized_host` (GHSA-9crm-g4mf-wc5j)
+- fixes `Addressable::IDNA.to_unicode` decoding Punycode labels with
+  characters that change how a host displays without being visible
+  themselves, such as bidi overrides and isolates (e.g. U+202E and U+2066),
+  zero width characters and control characters; such a label is now
+  returned unchanged, so `Addressable::URI#display_uri` no longer shows
+  them. The pure-Ruby backend also no longer decodes labels with other
+  characters that nameprep prohibits, as with libidn (GHSA-539f-xcgw-2gjg)
+- fixes `Addressable::URI#route_from` and `#route_to` raising
+  `InvalidURIError` when the route's first segment contains a colon
+  (e.g. `/a:b` from `/a`); the route is now `./a:b` ([#625])
+- fixes `Addressable::IDNA.to_unicode` raising in the pure-Ruby backend for
+  Punycode labels that are too long, overflow the decoder, or decode past
+  U+10FFFF; the label is now returned unchanged, as with libidn, so
+  `Addressable::URI#display_uri` no longer raises for such hosts ([#620])
+- fixes `Addressable::URI#display_uri` raising `InvalidURIError` for URIs
+  without a host, such as `abc` or `mailto:user@example.com`; relative URIs
+  are also no longer displayed with an empty authority (e.g. `/path/to` was
+  displayed as `///path/to`) ([#610])
+- fixes `Addressable::Template#match` and `#extract` raising
+  `Addressable::URI::InvalidURIError` for a string that isn't a valid URI;
+  they now return `nil`, as for any other URI that doesn't match ([#621])
+- fixes `Addressable::URI#origin=` raising `InvalidURIError` for an origin
+  with an empty port (e.g. `http://example.com:`), which is the same as no
+  port ([#627])
+
+[#610]: https://github.com/sporkmonger/addressable/pull/610
+[#620]: https://github.com/sporkmonger/addressable/pull/620
+[#621]: https://github.com/sporkmonger/addressable/pull/621
+[#625]: https://github.com/sporkmonger/addressable/pull/625
+[#627]: https://github.com/sporkmonger/addressable/pull/627
+
+## Addressable 2.9.0 <a name="v2.9.0">
+- fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete
+  remediation in 2.8.10)
+
 ## Addressable 2.8.10 <a name="v2.8.10">
 - fixes ReDoS vulnerability in Addressable::Template#match
 

data/lib/addressable/idna/native.rb

@@ -51,10 +51,18 @@ module Addressable
       end.join('.')
     end
 
+    # Characters that change how a label displays without being visible
+    # themselves: controls, format characters such as bidi overrides and
+    # isolates, and default ignorable code points. libidn rejects most of
+    # them, but not those added to Unicode after the version it checks
+    # against, such as U+2066 to U+2069.
+    DISPLAY_CHANGING = /[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/
+
     def self.to_unicode(value)
       value.to_s.split('.', -1).map do |segment|
         if segment.size > 0 && segment.size < 64
-          IDN::Idna.toUnicode(segment, IDN::Idna::ALLOW_UNASSIGNED)
+          decoded = IDN::Idna.toUnicode(segment, IDN::Idna::ALLOW_UNASSIGNED)
+          decoded =~ DISPLAY_CHANGING ? segment : decoded
         elsif segment.size >= 64
           segment
         else

data/lib/addressable/idna/pure.rb

@@ -55,6 +55,39 @@ module Addressable
       | \xF4[\x80-\x8F][\x80-\xBF]{2}       # plane 16
       )/mnx
 
+    # Characters that nameprep doesn't allow in a label (Section 5 of
+    # RFC 3491), or that it maps to nothing, so they can't be in a label that
+    # toASCII produces.
+    NAMEPREP_PROHIBITED = Regexp.new("[" + [
+      # Table C.1.2, non-ASCII space characters
+      "\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000",
+      # Table C.2.2, non-ASCII control characters
+      "\u0080-\u009F\u06DD\u070F\u180E\u200C\u200D\u2028\u2029" +
+        "\u2060-\u2063\u206A-\u206F\uFEFF\uFFF9-\uFFFC\u{1D173}-\u{1D17A}",
+      # Table C.3, private use
+      "\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}",
+      # Table C.4, non-character code points
+      "\uFDD0-\uFDEF" + (0..16).map do |plane|
+        [plane * 0x10000 + 0xFFFE, 0x2D, plane * 0x10000 + 0xFFFF].pack("U*")
+      end.join,
+      # Table C.6, inappropriate for plain text
+      "\uFFF9-\uFFFD",
+      # Table C.7, inappropriate for canonical representation
+      "\u2FF0-\u2FFB",
+      # Table C.8, change display properties or are deprecated
+      "\u0340\u0341\u200E\u200F\u202A-\u202E\u206A-\u206F",
+      # Table C.9, tagging characters
+      "\u{E0001}\u{E0020}-\u{E007F}",
+      # Table B.1, commonly mapped to nothing
+      "\u00AD\u034F\u1806\u180B-\u180D\u200B-\u200D\u2060\uFE00-\uFE0F\uFEFF"
+    ].join + "]")
+
+    # Characters that change how a label displays without being visible
+    # themselves: controls, format characters such as bidi overrides and
+    # isolates, and default ignorable code points, including those added to
+    # Unicode after the version nameprep is based on.
+    DISPLAY_CHANGING = /[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/
+
     # :startdoc:
 
     # Converts from a Unicode internationalized domain name to an ASCII
@@ -91,8 +124,22 @@ module Addressable
       parts.map! do |part|
         if part =~ /^#{ACE_PREFIX}(.+)/
           begin
-            punycode_decode(part[/^#{ACE_PREFIX}(.+)/, 1])
-          rescue Addressable::IDNA::PunycodeBadInput
+            decoded = punycode_decode(part[/^#{ACE_PREFIX}(.+)/, 1])
+            # A label that doesn't convert back to itself isn't a valid
+            # A-label (Section 4.2 of RFC 3490, steps 6 and 7). That includes
+            # a label that decodes to only ASCII characters. A label with a
+            # character that would change how it displays is returned
+            # unchanged too.
+            if to_ascii(decoded).downcase != part.downcase ||
+                decoded =~ NAMEPREP_PROHIBITED || decoded =~ DISPLAY_CHANGING
+              part
+            else
+              decoded
+            end
+          rescue Addressable::IDNA::PunycodeBadInput,
+                 Addressable::IDNA::PunycodeBigOutput,
+                 Addressable::IDNA::PunycodeOverflow,
+                 RangeError, ArgumentError
             # toUnicode is explicitly defined as never-fails by the spec
             part
           end

data/lib/addressable/template.rb

@@ -413,15 +413,25 @@ module Addressable
     #   match.captures
     #   #=> ["a", ["b", "c"]]
     def match(uri, processor=nil)
-      uri = Addressable::URI.parse(uri) unless uri.is_a?(Addressable::URI)
+      unless uri.is_a?(Addressable::URI)
+        begin
+          uri = Addressable::URI.parse(uri)
+        rescue Addressable::URI::InvalidURIError
+          # Per the documented contract, match returns nil for any input
+          # that doesn't match the template - including a string that
+          # isn't even a valid URI.
+          return nil
+        end
+      end
       mapping = {}
 
       # First, we need to process the pattern, and extract the values.
       expansions, expansion_regexp =
         parse_template_pattern(pattern, processor)
 
-      return nil unless uri.to_str.match(expansion_regexp)
-      unparsed_values = uri.to_str.scan(expansion_regexp).flatten
+      matched = uri.to_str.match(expansion_regexp)
+      return nil unless matched
+      unparsed_values = matched.captures
 
       if uri.to_str == pattern
         return Addressable::Template::MatchData.new(uri, self, mapping)
@@ -958,6 +968,77 @@ module Addressable
       end
     end
 
+    ##
+    # Describes what follows each expression in a template pattern.
+    #
+    # @param [String] escaped_pattern The escaped URI template pattern.
+    #
+    # @return [Array<Array>] For each expression, the <tt>MatchData</tt> of
+    #   the expression directly after it (or <tt>nil</tt>), and whether the
+    #   text after it could start with a comma.
+    def expression_followers(escaped_pattern)
+      expressions = escaped_pattern.to_enum(:scan, EXPRESSION).map do
+        Regexp.last_match
+      end
+      expressions.each_with_index.map do |current, index|
+        following = expressions[index + 1]
+        following = nil unless following && following.begin(0) == current.end(0)
+        # Expressions can match nothing, so look past any that can't start
+        # with a comma.
+        position = current.end(0)
+        comma = expressions[(index + 1)..-1].any? do |later|
+          break false unless later.begin(0) == position
+          position = later.end(0)
+          may_start_with_comma?(later[1], later[2])
+        end
+        [following, comma || escaped_pattern[position] == ',']
+      end
+    end
+
+    ##
+    # Whether an expression could match a string that starts with a comma.
+    #
+    # @param [String, nil] operator The expression's operator.
+    # @param [String] varlist The expression's variable list.
+    #
+    # @return [TrueClass, FalseClass]
+    def may_start_with_comma?(operator, varlist)
+      return false unless LEADERS.fetch(operator, '').empty?
+      operator == '+' || !(varlist =~ VARSPEC && $2 != '*')
+    end
+
+    ##
+    # Whether an expression, followed directly by another one, could only
+    # match characters that the other one could also match, in any amount.
+    #
+    # @param [MatchData] following The expression that follows.
+    # @param [String, nil] operator The operator of the first expression.
+    # @param [Array<String>] varspecs The varspecs of the first expression.
+    #
+    # @return [TrueClass, FalseClass]
+    def absorbed_by?(following, operator, varspecs)
+      last = following[2].split(',').last
+      case following[1]
+      when '+'
+        # An unexploded last variable matches any characters that an
+        # expression can, and can end anywhere.
+        last[VARSPEC, 2] != '*'
+      when nil
+        if last[VARSPEC, 2] == '*'
+          # Matches any unreserved characters and commas.
+          operator.nil? || operator == '.'
+        elsif following[2] == last
+          # Matches any unreserved characters.
+          operator == '.' || (operator.nil? && varspecs.size == 1 &&
+            varspecs.first[VARSPEC, 2] != '*')
+        else
+          false
+        end
+      else
+        false
+      end
+    end
+
     ##
     # Generates the <tt>Regexp</tt> that parses a template pattern.
     #
@@ -978,19 +1059,36 @@ module Addressable
       end
 
       expansions = []
+      # Processor patterns can match anything, so they get 2.9.0's choices.
+      plain_processor = !(processor && processor.respond_to?(:match))
+      followers = expression_followers(escaped_pattern)
 
       # Create a regular expression that captures the values of the
       # variables in the URI.
       regexp_string = escaped_pattern.gsub( EXPRESSION ) do |expansion|
 
+        index = expansions.size
         expansions << expansion
         _, operator, varlist = *expansion.match(EXPRESSION)
         leader = Regexp.escape(LEADERS.fetch(operator, ''))
         joiner = Regexp.escape(JOINERS.fetch(operator, ','))
-        combined = varlist.split(',').map do |varspec|
+        varspecs = varlist.split(',')
+        results = varspecs.map do |varspec|
+          name = varspec[VARSPEC, 1]
+          processor && processor.respond_to?(:match) ? processor.match(name) : nil
+        end
+        # Without processor patterns, any variable in the expression can take
+        # the characters that an earlier variable leaves, which lets the
+        # variables after the first one have fewer choices below.
+        plain = results.compact.empty?
+        explodes = varspecs.map { |varspec| varspec[VARSPEC, 2] == '*' }
+        first_explode = explodes.index(true)
+        not_after_value =
+          "(?<![#{Addressable::URI::CharacterClasses::UNRESERVED}])"
+        combined = varspecs.each_with_index.map do |varspec, index|
           _, name, modifier = *varspec.match(VARSPEC)
 
-          result = processor && processor.respond_to?(:match) ? processor.match(name) : nil
+          result = results[index]
           if result
             "(?<#{name}>#{ result })"
           else
@@ -1004,7 +1102,9 @@ module Addressable
             when '.'
               "#{ UNRESERVED.gsub('\.', '') }*?"
             when ';'
-              "#{ UNRESERVED }*=?#{ UNRESERVED }*?"
+              # The same strings, tried in the same order, as 2.9.0's
+              # "U*=?U*?", but a name without "=" can only match one way.
+              "(?:#{UNRESERVED}*=#{UNRESERVED}*?|#{UNRESERVED}*)"
             when '?'
               "#{ UNRESERVED }*=#{ UNRESERVED }*?"
             when '&'
@@ -1013,16 +1113,117 @@ module Addressable
               "#{ UNRESERVED }*?"
             end
             if modifier == '*'
+              # The ; ? and & members match the same strings, in the same
+              # order of preference, as 2.9.0's members joined by an optional
+              # joiner, but each character can only belong to one member.
               seg = case operator
                     when '+', '#' then "#{RESERVED_NO_COMMA}*+"
+                    when ';' then "(?:#{UNRESERVED}|=)*"
+                    when '?', '&'
+                      "#{UNRESERVED}*=(?:#{UNRESERVED}*=)*#{UNRESERVED}*?"
                     else group
                     end
-              "(?<#{name}>#{seg}(?:#{joiner}?#{seg})*)?"
+              # The joiner between exploded members must be mandatory. With
+              # an optional joiner, a run of members can be partitioned in
+              # exponentially many ways, which backtracks catastrophically on
+              # engines without match memoization (MRI < 3.2, JRuby,
+              # TruffleRuby).
+              value = "#{seg}(?:#{joiner}#{seg})*"
+            end
+            if plain && first_explode && index > first_explode &&
+                (operator == '+' || operator == '#' || operator == ';')
+              # Exploded values were tried longest first, so whatever this
+              # variable could match after the first exploded one, that one
+              # already tried matching itself. Only the last unexploded + or
+              # # variable can stop inside a member, where an exploded
+              # variable can't. As in 2.9.0, a variable is the last one if
+              # its varspec is the same as the last varspec.
+              if operator == ';'
+                "(?<#{name}>)"
+              elsif modifier != '*' && varspec == varspecs.last
+                "(?<#{name}>#{RESERVED_NO_COMMA}*?)?"
+              else
+                # 2.9.0 skipped the variable when it couldn't be empty.
+                "(?:(?<#{name}>)(?!#{RESERVED_NO_COMMA}))?"
+              end
+            elsif plain && modifier == '*' && explodes[(index + 1)..-1].any? &&
+                (operator.nil? || operator == '/' || operator == '.')
+              # Exploded values were tried shortest first, and a later
+              # exploded variable can match whatever this one leaves, so once
+              # a split fails, every split where this variable is longer
+              # fails too. Of the values tried, only the leading joiners are
+              # shorter than every value tried before them.
+              "(?<#{name}>(?:#{joiner})*)"
+            elsif plain && index > 0 && explodes[index - 1] &&
+                (operator == '?' || operator == '&')
+              # Whatever this variable could match after an exploded one,
+              # that one already tried matching itself, unless it couldn't:
+              # an exploded member can't be empty, so this variable may only
+              # start right after an empty one.
+              "(?<#{name}>(?<=#{leader}#{joiner}|#{joiner}#{joiner})" \
+                "#{value || group})?"
+            elsif operator == ';' && plain && index > 0
+              # Values were tried longest first, and splitting an earlier
+              # variable's run of characters with this one never gave a
+              # different result, so this one may only start after that run.
+              "(?<#{name}>(?:#{not_after_value}#{value || group})?)"
+            elsif modifier == '*'
+              "(?<#{name}>#{value})?"
+            elsif varspecs.size > 1 && (operator == '+' || operator == '#') &&
+                  varspec != varspecs.last
+              "(?<#{name}>#{RESERVED_NO_COMMA}*+)?"
+            elsif plain && index < varspecs.size - 1 &&
+                  (operator.nil? || operator == '/' || operator == '.')
+              # Values were tried shortest first, so a run of characters
+              # without a joiner went to a later variable. The only other
+              # value that could change the result is the whole run up to the
+              # next joiner.
+              "(?<#{name}>(?:#{group}(?=#{joiner}))??)"
             else
               "(?<#{name}>#{group})?"
             end
           end
-        end.join("#{joiner}?")
+        end
+        following, comma_follows = followers[index]
+        single = varspecs.size == 1 && varspecs.first[VARSPEC, 2] != '*'
+        if plain_processor && following &&
+            absorbed_by?(following, operator, varspecs)
+          # Each expression tried its empty alternative first. When the next
+          # one follows it directly and can match anything it could, followed
+          # by anything the next one could match on its own, every other
+          # choice ends where the empty one can also end, so the empty
+          # alternative always gave the first match.
+          leader = "(?!)#{leader}"
+          combined = combined.join("#{joiner}?")
+        elsif plain_processor && single && following &&
+            following[1].nil? && following[2] =~ VARSPEC && $2 != '*' &&
+            (operator == '+' || operator == '#')
+          # Values were tried shortest first, and the next expression can
+          # match any unreserved characters, so the value only needs to end
+          # after a character that the next expression couldn't match.
+          combined = "(?<#{varspecs.first[VARSPEC, 1]}>" \
+            "#{RESERVED}*?#{not_after_value})?"
+        elsif plain && varspecs.size > 1 &&
+            (operator == '+' || operator == '#') &&
+            !comma_follows &&
+            varspecs.none? { |varspec| varspec[VARSPEC, 2] == '*' } &&
+            !varspecs[0...-1].include?(varspecs.last)
+          # 2.9.0 tried each value with the joiner after it first, then the
+          # value on its own, then skipping the variable, and every other
+          # choice gave a value to a later variable that an earlier one had
+          # already been tried with. A variable after a skipped one is
+          # skipped too. Stopping before a joiner is left out, so this is
+          # only used when no joiner can follow the expression. As in 2.9.0,
+          # a variable is the last one if its varspec is the same as the
+          # last varspec.
+          nested = varspecs[0...-1].reverse.inject("") do |inner, varspec|
+            "(?:(?<#{varspec[VARSPEC, 1]}>#{RESERVED_NO_COMMA}*+)" \
+              "#{joiner}?+#{inner}|(?=#{RESERVED_NO_COMMA}))"
+          end
+          combined = nested + combined.last
+        else
+          combined = combined.join("#{joiner}?")
+        end
         "(?:|#{leader}#{combined})"
       end
 

data/lib/addressable/uri.rb

@@ -1345,6 +1345,10 @@ module Addressable
           raise InvalidURIError, 'An origin cannot omit the host.'
         end
         new_port = new_origin[/:([^:@\[\]\/]*?)$/, 1]
+        # An empty port is the same as no port (Section 3.2.3 of RFC 3986).
+        if new_port == EMPTY_STR && new_origin =~ /\A[^:\/?#]+:\/\/[^\/?#:@\[\]]+:\z/
+          new_port = nil
+        end
       end
 
       self.scheme = new_scheme
@@ -2126,6 +2130,11 @@ module Addressable
       if components[:host] != nil
         components[:scheme] = normalized_self.scheme
       end
+      # A first segment containing a colon would be read as a scheme.
+      if components[:scheme].nil? && components[:path] &&
+          components[:path][/\A[^\/]*/].include?(":")
+        components[:path] = "./" + components[:path]
+      end
       return Addressable::URI.new(
         :scheme => components[:scheme],
         :user => components[:user],
@@ -2200,7 +2209,7 @@ module Addressable
     # @return [Addressable::URI] A URI suitable for display purposes.
     def display_uri
       display_uri = self.normalize
-      display_uri.host = ::Addressable::IDNA.to_unicode(display_uri.host)
+      display_uri.host = ::Addressable::IDNA.to_unicode(display_uri.host) if display_uri.host
       return display_uri
     end
 
@@ -2394,13 +2403,14 @@ module Addressable
     # @param [Proc] block
     #   A set of operations to perform on a given URI.
     def defer_validation
+      validation_was_deferred = !!@validation_deferred
       raise LocalJumpError, "No block given." unless block_given?
       @validation_deferred = true
       yield
-      @validation_deferred = false
-      validate
+      @validation_deferred = validation_was_deferred
+      validate unless validation_was_deferred
     ensure
-      @validation_deferred = false
+      @validation_deferred = validation_was_deferred
     end
 
     def encode_with(coder)
@@ -2426,10 +2436,14 @@ module Addressable
     SELF_REF = '.'
     PARENT = '..'
 
+    # Deprecated. No longer used by normalize_path; will be removed in 2.10.0.
     RULE_2A = /\/\.\/|\/\.$/
     RULE_2B_2C = /\/([^\/]*)\/\.\.\/|\/([^\/]*)\/\.\.$/
     RULE_2D = /^\.\.?\/?/
     RULE_PREFIXED_PARENT = /^\/\.\.?\/|^(\/\.\.?)+\/?$/
+    if respond_to?(:deprecate_constant, true)
+      deprecate_constant :RULE_2A, :RULE_2B_2C, :RULE_2D, :RULE_PREFIXED_PARENT
+    end
 
     ##
     # Resolves paths to their simplest form.
@@ -2438,37 +2452,52 @@ module Addressable
     #
     # @return [String] The normalized path.
     def self.normalize_path(path)
-      # Section 5.2.4 of RFC 3986
+      # Section 5.2.4 of RFC 3986, as a single pass over the segments so that
+      # the running time is linear in the length of the path.
 
       return if path.nil?
-      normalized_path = path.dup
-      loop do
-        mod ||= normalized_path.gsub!(RULE_2A, SLASH)
-
-        pair = normalized_path.match(RULE_2B_2C)
-        if pair
-          parent  = pair[1]
-          current = pair[2]
+      segments = path.split(SLASH, -1)
+      return path.dup if segments.empty?
+
+      # The first segment is never removed by a parent reference. For an
+      # absolute path it is the empty segment before the leading slash.
+      output = [segments.first]
+      last = segments.size - 1
+      (1..last).each do |index|
+        segment = segments[index]
+        if segment == SELF_REF
+          output << EMPTY_STR if index == last
+        elsif segment == PARENT
+          if output.size > 1
+            output.pop
+            output << EMPTY_STR if index == last
+          else
+            output << PARENT
+          end
         else
-          parent  = nil
-          current = nil
+          output << segment
         end
-
-        regexp = "/#{Regexp.escape(parent.to_s)}/\\.\\./|"
-        regexp += "(/#{Regexp.escape(current.to_s)}/\\.\\.$)"
-
-        if pair && ((parent != SELF_REF && parent != PARENT) ||
-            (current != SELF_REF && current != PARENT))
-          mod ||= normalized_path.gsub!(Regexp.new(regexp), SLASH)
+      end
+      normalized_path = output.join(SLASH)
+
+      # Non-standard, removes prefixed dotted segments from path. At this
+      # point an absolute path can only start with a single "/..", and a
+      # relative path keeps its leading dots.
+      start = 0
+      if normalized_path.start_with?(SLASH)
+        if normalized_path == "/#{PARENT}"
+          return normalized_path[0, 1]
+        elsif normalized_path.start_with?("/#{PARENT}/")
+          start = PARENT.size + 1
+        end
+      else
+        while normalized_path[start] == SELF_REF
+          start += 1
+          start += 1 if normalized_path[start] == SELF_REF
+          start += 1 if normalized_path[start] == SLASH
         end
-
-        mod ||= normalized_path.gsub!(RULE_2D, EMPTY_STR)
-        # Non-standard, removes prefixed dotted segments from path.
-        mod ||= normalized_path.gsub!(RULE_PREFIXED_PARENT, SLASH)
-        break if mod.nil?
       end
-
-      normalized_path
+      start.zero? ? normalized_path : normalized_path[start..-1]
     end
 
     ##

data/lib/addressable/version.rb

@@ -22,8 +22,8 @@ if !defined?(Addressable::VERSION)
   module Addressable
     module VERSION
       MAJOR = 2
-      MINOR = 8
-      TINY  = 10
+      MINOR = 9
+      TINY  = 1
 
       STRING = [MAJOR, MINOR, TINY].join('.')
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: addressable
 version: !ruby/object:Gem::Version
-  version: 2.8.10
+  version: 2.9.1
 platform: ruby
 authors:
 - Bob Aman
@@ -53,7 +53,7 @@ homepage: https://github.com/sporkmonger/addressable
 licenses:
 - Apache-2.0
 metadata:
-  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.8.10
+  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.1
 rdoc_options:
 - "--main"
 - README.md
@@ -70,7 +70,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: URI Implementation
 test_files: []