Skip to content

Commit 231ef36

Browse files
committed
Avoid ReDoS problem
Split headers on commas, then strip the strings in order to avoid ReDoS issues. [CVE-2023-27539]
1 parent e9e9ae6 commit 231ef36

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

lib/rack/request.rb

+2-2
Original file line numberDiff line numberDiff line change
@@ -666,8 +666,8 @@ def wrap_ipv6(host)
666666
end
667667

668668
def parse_http_accept_header(header)
669-
header.to_s.split(/\s*,\s*/).map do |part|
670-
attribute, parameters = part.split(/\s*;\s*/, 2)
669+
header.to_s.split(",").each(&:strip!).map do |part|
670+
attribute, parameters = part.split(";", 2).each(&:strip!)
671671
quality = 1.0
672672
if parameters and /\Aq=([\d.]+)/ =~ parameters
673673
quality = $1.to_f

0 commit comments

Comments
 (0)