route_translator 16.1.0 → 16.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +4 -0
- data/README.md +5 -0
- data/lib/route_translator/host.rb +5 -1
- data/lib/route_translator/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: ce208e97dd68df337f8bd665d8e922f7a1bd0560757ac722e44c51caeabb5d35
|
|
4
|
+
data.tar.gz: c78dd9a7520d839c5066afe290dafe7d1fa6166473de0567109c5c74b613b19b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7798fd662c28bb906c3ad125b61d616e5894557623657a8bda16ab6b0a54b2fea202fd36f214d2a4b51704ddeeba41ea1785747d892c6ba5f1cf3d08b66821e7
|
|
7
|
+
data.tar.gz: c26787fa838f3a1a315fb46b5168c34ecb720cfb09521f5d0783f27834ace2f41bbcea989eaf4fe59489b2b1ba959d7396b3db4e1ff19e93067d8420e19b07d3
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 16.2.0 / 2026-07-29
|
|
4
|
+
|
|
5
|
+
* [ENHANCEMENT] Short-circuit host locale detection by checking `available_locales.include?` before the regex match, avoiding unnecessary regex compilation and matching for unavailable locales.
|
|
6
|
+
|
|
3
7
|
## 16.1.0 / 2026-07-28
|
|
4
8
|
|
|
5
9
|
* [ENHANCEMENT] Speed up drawing localized routes. `Translator.translate_name` asked the route set for `named_routes.names` (a freshly allocated array of every name defined so far) and scanned it linearly, once per route per locale. It now uses the `NamedRouteCollection#key?` hash lookup.
|
data/README.md
CHANGED
|
@@ -321,6 +321,11 @@ This is to avoid odd behaviour brought about by route conflicts and because `hos
|
|
|
321
321
|
|
|
322
322
|
NOTE: locale from parameters has priority over the one from hosts.
|
|
323
323
|
|
|
324
|
+
**Security note:** Host patterns are treated as trusted configuration.
|
|
325
|
+
Never pass user input into `host_locales` keys — the wildcard `*` is
|
|
326
|
+
translated to a non-greedy `.*?` regex, which can expose your application
|
|
327
|
+
to ReDoS if an attacker controls the pattern.
|
|
328
|
+
|
|
324
329
|
### Translations for similar routes with different namespaces
|
|
325
330
|
|
|
326
331
|
If you have routes that (partially) share names in one locale, but must be translated differently in another locale, for example:
|
|
@@ -9,6 +9,10 @@ module RouteTranslator
|
|
|
9
9
|
@lambdas ||= {}
|
|
10
10
|
end
|
|
11
11
|
|
|
12
|
+
# Host patterns come from configuration, not user input.
|
|
13
|
+
# Treating them as trusted avoids a ReDoS vector — the
|
|
14
|
+
# gsub introduces non-greedy `.*?` wildcards, which are
|
|
15
|
+
# safe against backtracking only under that assumption.
|
|
12
16
|
def regex_for(host_string)
|
|
13
17
|
escaped = Regexp.escape(host_string).gsub(/\\\*|\\\./, '\\*' => '.*?', '\\.' => '\.?')
|
|
14
18
|
Regexp.new("^#{escaped}$", Regexp::IGNORECASE)
|
|
@@ -21,7 +25,7 @@ module RouteTranslator
|
|
|
21
25
|
available_locales = I18n.available_locales
|
|
22
26
|
|
|
23
27
|
RouteTranslator.config.host_locales.find do |pattern, locale|
|
|
24
|
-
host&.match?(regex_for(pattern))
|
|
28
|
+
available_locales.include?(locale&.to_sym) && host&.match?(regex_for(pattern))
|
|
25
29
|
end&.last&.to_sym
|
|
26
30
|
end
|
|
27
31
|
|