ReDoS vulnerability in ActiveAttr::Typecasting::BooleanTypecaster#call

[wonda-tea-coffee]

Detail

This method determines if it matches the following regular expression.
https://github.com/cgriego/active_attr/blob/v0.15.2/lib/active_attr/typecasting/boolean_typecaster.rb#L45

For example, it will take a lot of time to match if the input is something like this.

"#{?0 * 100000}a" =~ /\A[-+]?(0+\.?0*|0*\.?0+)\z/

Solution

Use possessive quantifier.
This will return an immediate result for the input in question, while maintaining compatibility.

diff --git a/lib/active_attr/typecasting/boolean_typecaster.rb b/lib/active_attr/typecasting/boolean_typecaster.rb
index 8b84102..5250ca8 100644
--- a/lib/active_attr/typecasting/boolean_typecaster.rb
+++ b/lib/active_attr/typecasting/boolean_typecaster.rb
@@ -42,7 +42,7 @@ module ActiveAttr
         case value
         when *FALSE_VALUES then false
         when *NIL_VALUES then nil
- when Numeric, /\A[-+]?(0+\.?0*|0*\.?0+)\z/ then !value.to_f.zero?
+ when Numeric, /\A[-+]?(0++\.?0*|0*+\.?0+)\z/ then !value.to_f.zero?
         else value.present?
         end
       end

[cgriego]

Sounds good to me. Can you open a pull request? @wonda-tea-coffee

[wonda-tea-coffee]

@cgriego
I made a PR 👍
#185