9

Ruby introduces Regexp.timeout

 2 years ago
source link: https://blog.saeloun.com/2022/08/09/ruby-introduces-regexp-timeout
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

Ruby introduces Regexp.timeout

Aug 9, 2022 , by Agnidipta Bhattacharjee

2 minute read

Regular expressions (regexps) are codes that demonstrates the contents of a string. They’re generally used to test a string’s patterns and determine which portions of the string are a match to the output desired.

  • Syntax: Regexp.=~()
  • Parameter: Regexp values
  • Return: true – if two expressions matches string, if there is no match, then it will return False.

They are usually built with the /pat/ and %r{pat} literals or the Regexp.new constructor.

A regexp is usually confined within forward slashes (/). For example:

/par/ =~ 'parrot'   #=> 0
/p/.match('parrot') #=> #<MatchData "p">

If a string has the pattern we are looking for, then it is said to be a match.

Here, the word, ‘parrot’ does not have the pattern ‘beak’, so it doesn’t match:

/beak/.match('parrot') #=> nil

Here, ‘parrot’ contains the pattern ‘par’, so it matches:

/par/.match('parrot')    #=> #<MatchData "par">

Remember that any Regexp matching will display a RuntimeError when a timeout is set and exceeded. This is why, oftentimes, the codes may get exploited by malicious users for DoS or ReDoS.

Therefore, to prevent or mitigate the risk of DoS, Regexp.timeout is introduced by Ruby.

Timeout

There are two APIs to set timeout. They are:

  • Timeout.timeout= it is the process-global configuration of timeout for Regexp matching.
  • Timeout keyword of Regexp.new.= it is used when we want to try different timeout settings for some special Regexps
Timeout.timeout
Regexp.timeout = 4
q = 'a' * 25 + 'd' + 'a' * 4 + 's' #=> "aaaaaaaaaaaaaaaaaaaaaaaaadaaaas"
/(b|a+)*s/ =~ q  #=> Regexp::TimeoutError is raised in four seconds
Timeout keyword of Regexp.new
re = Regexp.new("(b|a+)*c", timeout: 4)
q = 'a' * 25 + 'd' + 'a' * 4 + 's' #=> "aaaaaaaaaaaaaaaaaaaaaaaaadaaaas"
/(b|a+)*s/ =~ q  #=> Regexp::TimeoutError is raised in four seconds

When we are using Regexp to run an untrusted output, its important to understand and use the timeout feature to prevent multiple backtracking.

If not done, the code will be prone to Denial-of-Service attack as an attacker might exploit it by providing an input to Regexp as the code might be otherwise matching an ineffecient Regexp.

Let’s not forget that the timeout is not set by default as an appropriate limit is usually determined by the application needs and content.


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK