From: "byroot (Jean Boussier) via ruby-core" Date: 2026-11-04T08:42:33+00:00 Subject: [ruby-core:127329] [Ruby Misc#22502] Clarify whether compiling an untrusted string into a Regexp is supported Issue #22502 has been updated by byroot (Jean Boussier). I second what Jeremy said, for the currently released versions I don't think we can reasonably claim that `Regexp.new` can safely accept untrusted input. However if the relevant maintainers wish to make this a goal, then it's up to them, but it should only apply to future Ruby versions. ---------------------------------------- Misc #22502: Clarify whether compiling an untrusted string into a Regexp is supported https://bugs.ruby-lang.org/issues/22502#change-119761 * Author: k0kubun (Takashi Kokubun) * Status: Open ---------------------------------------- ## Proposal Decide whether compiling an untrusted string into a Regexp is a supported use case, and document the decision. * If it's not supported: * Document it in `Regexp.new` and [doc/security/security.rdoc](https://docs.ruby-lang.org/en/master/security/security_rdoc.html), like `Marshal.load` and `eval`. * Treat memory corruption bugs that only untrusted patterns can trigger as normal bugs. * If it's supported: * Treat such bugs as vulnerabilities. * Request CVEs for the recent fixes: [#13332](https://github.com/ruby/ruby/pull/13332), [#19020](https://github.com/ruby/ruby/pull/19020), and [#16801](https://github.com/ruby/ruby/pull/16801). ## Background * Ruby 4.0.9, 3.4.12, and 3.3.13 fixed Regexp compilation bugs that led to RCE on GitLab. GitLab assigned CVEs to them, but we haven't requested CVEs for Ruby itself. See [the announcement](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/). * The current documentation is not clear about it: * The [CVE-2022-28738 advisory](https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/) says "in general, it is considered unsafe to create and use a Regexp object generated from untrusted input", but we still assigned a CVE to it. We did the same for CVE-2024-27282. * [The Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) mentions untrusted sources only for DoS, and recommends `Regexp.timeout`. * It's not only `Regexp.new` and `/#{...}/`. `String#match` and `String#match?` also compile a String argument, e.g. `"str".match?(user_input)`. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/