gettalong / hexapdf

Versatile PDF creation and manipulation for Ruby
https://hexapdf.gettalong.org
Other
1.21k stars 69 forks source link

regex fix #286

Closed dpep closed 6 months ago

dpep commented 6 months ago

Hey there! I saw a minor security vulnerability with a regex in this library. In trying to match a hexidecimal character, the regex does /A-f/ - note that A-f is a much larger range than A-F and includes some fun character (see ('A'...'f').to_a). The simpliest fix is changing the regex to be

name =~ /\Au([0-9A-f]{4,6})\Z/

but then I discovered that Ruby regex has it's own shorthand for matching hex characters \h, which seems even better. are you open to fixing this regex?

gettalong commented 6 months ago

Thanks you! However, the spec for this part says that only uppercase letters are allowed, so using \h is not a valid change.

I have gone ahead and fixed the typo, thanks again for discovering it.