alt Hacker NewsIt's a Bad Idea (TM) to compile a regular expression from an untrusted input.
Despite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.
Replies
Despite this Ruby should have requested CVE numbers. They created a patch that was available to install and prevented this attack. CVE numbers would have triggered automations to update Ruby in everyones systems.
> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.
i agree with you!
nevertheless,
> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment
not sure what sort of comprehensive assessment is still called for at this point?
A regex might be a programming language, a proper regular expression (which there are libraries for, like Google RE2) is just a regular language and I don't think you can even charitably call that a programming language.