Misc #22502: Clarify whether compiling an untrusted string into a Regexp is supported

• Status: Open
• Assignee: -

[k0kubun (Takashi Kokubun)]

Proposal

Decide whether compiling an untrusted string into a Regexp is a supported use case, and document the decision.

• If it's not supported:
  • Document it in Regexp.new and doc/security/security.rdoc, like Marshal.load and eval.
  • Treat memory corruption bugs that only untrusted patterns can trigger as normal bugs.
• If it's supported:
  • Treat such bugs as vulnerabilities.
  • Request CVEs for the recent fixes: #13332, #19020, and #16801.

Background

• Ruby 4.0.9, 3.4.12, and 3.3.13 fixed Regexp compilation bugs that led to RCE on GitLab. GitLab assigned CVEs to them, but we haven't requested CVEs for Ruby itself. See the
  announcement.
• The current documentation is not clear about it:
  • The CVE-2022-28738 advisory says "in general, it is considered unsafe to create and use a Regexp object generated from untrusted input", but we still assigned a CVE to it. We did the same for CVE-2024-27282.
  • The Regexp documentation mentions untrusted sources only for DoS, and recommends Regexp.timeout.
• It's not only Regexp.new and /#{...}/. String#match and String#match? also compile a String argument, e.g. "str".match?(user_input).

[jeremyevans0 (Jeremy Evans)]

IMO, creating a Regexp from an untrusted string should be unsupported. Ruby's Regexp was not designed to be used with untrusted input. Users that want to create regular expressions from untrusted input should use a regular expression engine designed for such a use case, such as re2.

[byroot (Jean Boussier)]

I second what Jeremy said, for the currently released versions I don't think we can reasonably claim that Regexp.new can safely accept untrusted input.

However if the relevant maintainers wish to make this a goal, then it's up to them, but it should only apply to future Ruby versions.

[duerst (Martin Dürst)]

I think we should use "security in depth" here, and not treat this as an exclusive OR. We should be very clear that it may be unsafe to create a Regexp from untrusted input. We can fix (and should) fix the documentation as quickly as possible. But we also should try very hard to avoid any bugs when creating Regexps from arbitrary input. I don't know much about the costs and benefits of CVEs, but in doubt, I think we should request them.