Vulnerability Summary
HackerOne disclosed report --> https://hackerone.com/reports/2389431 by ooooooo_q
I have found ReDoS in Action Text. However, it does not occur with Ruby 3.2 or later.
https://github.com/rails/rails/blob/v7.1.3.2/actiontext/lib/action_text/plain_text_conversion.rb#L64
def plain_text_for_blockquote_node(node, index)
text = plain_text_for_block(node)
text.sub(/\A(\s*)(.+?)(\s*)\Z/m, '\1“\2”\3')
end
HackerOne disclosed report --> https://hackerone.com/reports/3355766 by resurrect20
HackerOne disclosed report --> https://hackerone.com/reports/3670955 by glferreira-devsecops
HackerOne disclosed report --> https://hackerone.com/reports/3307874 by rorkh
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In