Skip to content

Commit

Permalink
Avoid ReDoS problem
Browse files Browse the repository at this point in the history
Split headers on commas, then strip the strings in order to avoid ReDoS
issues.

[CVE-2023-27539]
  • Loading branch information
tenderlove committed Mar 13, 2023
1 parent d6b5b2b commit ee7919e
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions lib/rack/request.rb
Original file line number Diff line number Diff line change
Expand Up @@ -572,8 +572,8 @@ def wrap_ipv6(host)
end

def parse_http_accept_header(header)
header.to_s.split(/\s*,\s*/).map do |part|
attribute, parameters = part.split(/\s*;\s*/, 2)
header.to_s.split(",").each(&:strip!).map do |part|
attribute, parameters = part.split(";", 2).each(&:strip!)
quality = 1.0
if parameters and /\Aq=([\d.]+)/ =~ parameters
quality = $1.to_f
Expand Down

0 comments on commit ee7919e

Please sign in to comment.