From: duerst via ruby-core <ruby-core@...>
Date: 2026-11-04T08:45:05+00:00
Subject: [ruby-core:127330] [Ruby Misc#22502] Clarify whether compiling an untrusted string into a Regexp is supported

Issue #22502 has been updated by duerst (Martin D�rst).


I think we should use "security in depth" here, and not treat this as an exclusive OR. We should be very clear that it may be unsafe to create a Regexp from untrusted input. We can fix (and should) fix the documentation as quickly as possible. But we also should try very hard to avoid any bugs when creating Regexps from arbitrary input. I don't know much about the costs and benefits of CVEs, but in doubt, I think we should request them.

----------------------------------------
Misc #22502: Clarify whether compiling an untrusted string into a Regexp is supported
https://bugs.ruby-lang.org/issues/22502#change-119762

* Author: k0kubun (Takashi Kokubun)
* Status: Open
----------------------------------------
## Proposal

Decide whether compiling an untrusted string into a Regexp is a supported use case, and document the decision.

* If it's not supported:
    * Document it in `Regexp.new` and [doc/security/security.rdoc](https://docs.ruby-lang.org/en/master/security/security_rdoc.html), like `Marshal.load` and `eval`.
    * Treat memory corruption bugs that only untrusted patterns can trigger as normal bugs.
* If it's supported:
    * Treat such bugs as vulnerabilities.
    * Request CVEs for the recent fixes: [#13332](https://github.com/ruby/ruby/pull/13332), [#19020](https://github.com/ruby/ruby/pull/19020), and [#16801](https://github.com/ruby/ruby/pull/16801).

## Background

* Ruby 4.0.9, 3.4.12, and 3.3.13 fixed Regexp compilation bugs that led to RCE on GitLab. GitLab assigned CVEs to them, but we haven't requested CVEs for Ruby itself. See [the
announcement](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/).
* The current documentation is not clear about it:
    * The [CVE-2022-28738 advisory](https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/) says "in general, it is considered unsafe to create and use a Regexp object generated from untrusted input", but we still assigned a CVE to it. We did the same for CVE-2024-27282.
    * [The Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) mentions untrusted sources only for DoS, and recommends `Regexp.timeout`.
* It's not only `Regexp.new` and `/#{...}/`. `String#match` and `String#match?` also compile a String argument, e.g. `"str".match?(user_input)`.



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/