q9f / eth.rb

a straightforward library to build, sign, and broadcast ethereum transactions anywhere you can run ruby.
https://q9f.github.io/eth.rb
Apache License 2.0
200 stars 86 forks source link

Checking userinfo with the uri method #233

Closed kurotaky closed 1 year ago

kurotaky commented 1 year ago

Fixed the basic auth decision in the http client so that it is not affected by ReDoS, which occurs in Ruby 3.1 and below.

close: https://github.com/q9f/eth.rb/security/code-scanning/10

Ruby 3.1.2

irb(main):001:0> RUBY_VERSION
=> "3.1.2"
irb(main):002:0> measure
TIME is added.
=> nil
irb(main):003:0>  /:.*@.*:/i =~ "https://example.com" * 1000
processing time: 0.069204s
=> nil
irb(main):004:0>  /:.*@.*:/i =~ "https://example.com" * 10000
processing time: 4.696144s
=> nil
irb(main):005:0>  /:.*@.*:/i =~ "https://example.com" * 50000
processing time: 119.181579s
=> nil

Ruby 3.2.0

irb(main):005:0> RUBY_VERSION
processing time: 0.000062s
=> "3.2.0"
irb(main):006:0> measure
processing time: 0.000090s
=> nil
irb(main):007:0>  /:.*@.*:/i =~ "https://example.com" * 1000
processing time: 0.001817s
=> nil
irb(main):008:0>  /:.*@.*:/i =~ "https://example.com" * 10000
processing time: 0.019022s
=> nil
irb(main):009:0>  /:.*@.*:/i =~ "https://example.com" * 100000
processing time: 0.101864s
=> nil
codecov-commenter commented 1 year ago

Codecov Report

Merging #233 (b520064) into main (3c3c806) will not change coverage. The diff coverage is 100.00%.

:mega: This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@           Coverage Diff           @@
##             main     #233   +/-   ##
=======================================
  Coverage   99.66%   99.66%           
=======================================
  Files          77       77           
  Lines        4432     4432           
=======================================
  Hits         4417     4417           
  Misses         15       15           
Impacted Files Coverage Δ
lib/eth/client/http.rb 100.00% <100.00%> (ø)

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more