Skip to content

Commit ee7919e

Browse files
committed
Avoid ReDoS problem
Split headers on commas, then strip the strings in order to avoid ReDoS issues. [CVE-2023-27539]
1 parent d6b5b2b commit ee7919e

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

lib/rack/request.rb

+2-2
Original file line numberDiff line numberDiff line change
@@ -572,8 +572,8 @@ def wrap_ipv6(host)
572572
end
573573

574574
def parse_http_accept_header(header)
575-
header.to_s.split(/\s*,\s*/).map do |part|
576-
attribute, parameters = part.split(/\s*;\s*/, 2)
575+
header.to_s.split(",").each(&:strip!).map do |part|
576+
attribute, parameters = part.split(";", 2).each(&:strip!)
577577
quality = 1.0
578578
if parameters and /\Aq=([\d.]+)/ =~ parameters
579579
quality = $1.to_f

0 commit comments

Comments
 (0)