Set Global timeout for Regexp to prevent ReDOS
1 unresolved thread
1 unresolved thread
Compare changes
Files
2- Aboobacker MK authored
@@ -121,6 +121,10 @@ def self.endpoint_id_for_action(action_name)
Set Global timeout for Regexp to prevent ReDOS
Ruby version 3.2 and above provides global configuration to prevent ReDoS by setting timeout. While we should still avoid writing vulnerable regular expressions, this will significantly reduce the attack surface.
Changelog: security
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots are required for UI changes, and strongly recommended for all other merge requests.
Before | After |
---|---|
Numbered steps to set up and validate the change are strongly suggested.