Skip to content

fix ReDoS#1823

Merged
jkowens merged 1 commit intosinatra:masterfrom
ooooooo-q:fix/redos
Oct 9, 2022
Merged

fix ReDoS#1823
jkowens merged 1 commit intosinatra:masterfrom
ooooooo-q:fix/redos

Conversation

@ooooooo-q
Copy link
Copy Markdown
Contributor

@ooooooo-q ooooooo-q commented Oct 8, 2022

I fixed ReDoS for Rack::Protection::IPSpoofing.
ReDOS occurs when a specially crafted header is received while using it.

PoC

ip_spoofing_benchmark.rb

require 'benchmark'

def attack_text(length)
 ("\t" * length +"\ta,a\t").split(/\s*,\s*/)
end

Benchmark.bm do |x|
  x.report { attack_text(10) }
  x.report { attack_text(100) }
  x.report { attack_text(1000) }
  x.report { attack_text(10000) }
  x.report { attack_text(100000) }
end
❯ bundle exec ruby ip_spoofing_benchmark.rb
       user     system      total        real
   0.000006   0.000001   0.000007 (  0.000005)
   0.000028   0.000000   0.000028 (  0.000027)
   0.002259   0.000012   0.002271 (  0.002272)
   0.223570   0.000703   0.224273 (  0.224464)
  22.489373   0.102019  22.591392 ( 22.658066)

olleolleolle
olleolleolle approved these changes Oct 9, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@olleolleolle olleolleolle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, this looks good!

@jkowens, this looks good to go!

@jkowens jkowens merged commit 8ff496b into sinatra:master Oct 9, 2022
This was referenced Nov 10, 2022
Closed
Closed
@github-actions github-actions Bot mentioned this pull request Nov 3, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@olleolleolle olleolleolle olleolleolle approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ooooooo-q @olleolleolle @jkowens