Skip to content

Commit 39e9eaf

Browse files
authored
Merge pull request #11986 from erik-krogh/redosNote2
RB: add note in ReDoS qhelp that Ruby 3.2 has fixed ReDoS
2 parents f4cb920 + 54b0350 commit 39e9eaf

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

ruby/ql/src/queries/security/cwe-1333/ReDoSIntroduction.inc.qhelp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@
1919
shape, increasing the input length by ten characters may make the
2020
automaton about 1000 times slower.
2121
</p>
22+
<p>
23+
Note that Ruby 3.2 and later have implemented a caching mechanism that
24+
completely eliminates the worst-case time complexity for the regular
25+
expressions flagged by this query. The regular expressions flagged by this
26+
query are therefore only problematic for Ruby versions prior to 3.2.
27+
</p>
2228
<p>
2329
Typically, a regular expression is affected by this problem if it contains
2430
a repetition of the form <code>r*</code> or <code>r+</code> where the

0 commit comments

Comments
 (0)