From: "jeremyevans0 (Jeremy Evans) via ruby-core" Date: 2026-11-04T01:23:51+00:00 Subject: [ruby-core:127323] [Ruby Misc#22502] Clarify whether compiling an untrusted string into a Regexp is supported Issue #22502 has been updated by jeremyevans0 (Jeremy Evans). IMO, creating a Regexp from an untrusted string should be unsupported. Ruby's Regexp was not designed to be used with untrusted input. Users that want to create regular expressions from untrusted input should use a regular expression engine designed for such a use case, such as re2. ---------------------------------------- Misc #22502: Clarify whether compiling an untrusted string into a Regexp is supported https://bugs.ruby-lang.org/issues/22502#change-119748 * Author: k0kubun (Takashi Kokubun) * Status: Open ---------------------------------------- ## Proposal Decide whether compiling an untrusted string into a Regexp is a supported use case, and document the decision. * If it's not supported: * Document it in `Regexp.new` and [doc/security/security.rdoc](https://docs.ruby-lang.org/en/master/security/security_rdoc.html), like `Marshal.load` and `eval`. * Treat memory corruption bugs that only untrusted patterns can trigger as normal bugs. * If it's supported: * Treat such bugs as vulnerabilities. * Request CVEs for the recent fixes: [#13332](https://github.com/ruby/ruby/pull/13332), [#19020](https://github.com/ruby/ruby/pull/19020), and [#16801](https://github.com/ruby/ruby/pull/16801). ## Background * Ruby 4.0.9, 3.4.12, and 3.3.13 fixed Regexp compilation bugs that led to RCE on GitLab. GitLab assigned CVEs to them, but we haven't requested CVEs for Ruby itself. See [the announcement](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/). * The current documentation is not clear about it: * The [CVE-2022-28738 advisory](https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/) says "in general, it is considered unsafe to create and use a Regexp object generated from untrusted input", but we still assigned a CVE to it. We did the same for CVE-2024-27282. * [The Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) mentions untrusted sources only for DoS, and recommends `Regexp.timeout`. * It's not only `Regexp.new` and `/#{...}/`. `String#match` and `String#match?` also compile a String argument, e.g. `"str".match?(user_input)`. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/