addressable 2.8.9 → 2.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d530bb874824f8d1004aaea0fb9cd6721e0bd791c404fcb1a15f79f821f056b1
-  data.tar.gz: a9f4955da072c19e998744fedd8dd12129027caae3f4854108054358ee0b740f
+  metadata.gz: ffaab8b78df30a2126058a425f168d76b26bc33e60849cabc1a6beabae24464d
+  data.tar.gz: 841ab2bd18fbcf3ff746cb85ea1661e628e278e6c7bc5ad96cd480e36a54f067
 SHA512:
-  metadata.gz: 216c9bf5530cd1265b9418864d0ab4222ce7040c5cbb5501e6185ad44058970423f025291511cbabad3e20115dab935476af53c4e4aeffd79a7e3423f6770045
-  data.tar.gz: 2c5ddcfa6e8e51bef14738173066debd7a54b920f68568e689d49bb0111ac0320d660440db8011912cd943f895ea0a4f62e387ac4699bde736c74db779c35845
+  metadata.gz: f5884313cb2c68ea73d25e8f7f0a76200030bb3fb7abad8b31532180b1ae3c1df10f8db614a273dba115c87860682d227fdf046c743370e020a577cae667d026
+  data.tar.gz: c97dd91446991ce20400e9b4c2586aefbc1dca9fd1d49efca9606fc505ff0d49807686ab1fdfd7d4dba447c9c4bf8fb6c0bbd5a1d3d69a4952207d035e912dc2

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## Addressable 2.9.0 <a name="v2.9.0">
+- fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete
+  remediation in 2.8.10)
+
+## Addressable 2.8.10 <a name="v2.8.10">
+- fixes ReDoS vulnerability in Addressable::Template#match
+
 ## Addressable 2.8.9 <a name="v2.8.9">
 - Reduce gem size by excluding test files ([#569])
 - No need for bundler as development dependency ([#571], [5fc1d93](https://github.com/sporkmonger/addressable/commit/5fc1d93))

data/lib/addressable/template.rb

@@ -39,6 +39,8 @@ module Addressable
       "(?>(?:[#{variable_char_class}]|%[a-fA-F0-9][a-fA-F0-9])+)"
     RESERVED =
       "(?:[#{anything}]|%[a-fA-F0-9][a-fA-F0-9])"
+    RESERVED_NO_COMMA =
+      "(?:[#{anything.delete(',')}]|%[a-fA-F0-9][a-fA-F0-9])"
     UNRESERVED =
       "(?:[#{
         Addressable::URI::CharacterClasses::UNRESERVED
@@ -985,7 +987,8 @@ module Addressable
         _, operator, varlist = *expansion.match(EXPRESSION)
         leader = Regexp.escape(LEADERS.fetch(operator, ''))
         joiner = Regexp.escape(JOINERS.fetch(operator, ','))
-        combined = varlist.split(',').map do |varspec|
+        varspecs = varlist.split(',')
+        combined = varspecs.map do |varspec|
           _, name, modifier = *varspec.match(VARSPEC)
 
           result = processor && processor.respond_to?(:match) ? processor.match(name) : nil
@@ -1011,7 +1014,15 @@ module Addressable
               "#{ UNRESERVED }*?"
             end
             if modifier == '*'
-              "(?<#{name}>#{group}(?:#{joiner}?#{group})*)?"
+              seg = case operator
+                    when '+', '#' then "#{RESERVED_NO_COMMA}*+"
+                    else group
+                    end
+              joiner_pattern = operator.nil? ? joiner : "#{joiner}?"
+              "(?<#{name}>#{seg}(?:#{joiner_pattern}#{seg})*)?"
+            elsif varspecs.size > 1 && (operator == '+' || operator == '#') &&
+                  varspec != varspecs.last
+              "(?<#{name}>#{RESERVED_NO_COMMA}*+)?"
             else
               "(?<#{name}>#{group})?"
             end

data/lib/addressable/version.rb

@@ -22,8 +22,8 @@ if !defined?(Addressable::VERSION)
   module Addressable
     module VERSION
       MAJOR = 2
-      MINOR = 8
-      TINY  = 9
+      MINOR = 9
+      TINY  = 0
 
       STRING = [MAJOR, MINOR, TINY].join('.')
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: addressable
 version: !ruby/object:Gem::Version
-  version: 2.8.9
+  version: 2.9.0
 platform: ruby
 authors:
 - Bob Aman
@@ -53,7 +53,7 @@ homepage: https://github.com/sporkmonger/addressable
 licenses:
 - Apache-2.0
 metadata:
-  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.8.9
+  changelog_uri: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md#v2.9.0
 rdoc_options:
 - "--main"
 - README.md
@@ -70,7 +70,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: URI Implementation
 test_files: []