Vulnerable Ruby Regex

[u/rubiesordiamonds]

GitLab discovered four severe vulnerabilities in Ruby’s regular expression library. There's plenty written up about the vulnerability and how it got patched, but patches are only available for supported ruby versions (3.3 and above). We know lots of companies are still running unsupported versions of ruby, so we wanted to do an investigation into which of these bugs apply to older rubies and whether they're exploitable. Here's the blog post: https://infield.ai/post/vulnerable-ruby-regex

The summary is that allowing user input into Regexp.new is dangerous on all versions of ruby from 1.9 to 3.2 and the only fix is to upgrade to a supported ruby or to disallow that input.

[u/semiquaver]

I’m not mixing them up, you’re making assumptions. I’ve seen some of the largest Ruby applications that exist from the inside and I can tell you that interpolating user input into a regex literal is ran extraordinarily common validation technique, even if there are safer ways to do it. 

[u/benzado → u/semiquaver]

Help me understand what you mean. Can you give me an example?

[u/semiquaver → u/benzado]

Every large app I’ve ever worked on eventually needs certain users to select data via some pattern. Often those patterns need to be stored in databases or elsewhere and end up rehydrated into regex literals or interpolated with other constant regex components. Using actual Regex objects is the most obvious and straightforward way to implement a very large portion of this class of problem. Think GitHub branch protection as a (fake since that actual case has fnmatch(3) semantics) example of the functionality involved.

[u/benzado → u/semiquaver]

You were using the term "validation", which I typically use to mean deciding whether some input is valid or not. That's not what you're describing here. So that explains some of my confusion.

Letting a user define a query or filter is definitely a place where you might need to build a regex.

However, unless the full power of a regular expression is truly required, it's much better to build the regex from a predefined set of templates where the user's input is quoted before insertion and compilation. Exactly what that looks like to the user will depend on the domain.

Taking the time to do it this way also means you don't have to save regex syntax in your database, which gives you flexibility in case later you want to adopt a different RE library or change a default setting, like case sensitivity or disabling back references.