Skip to content

Commit d829f16

Browse files
nobuhsbt
authored andcommitted
Test for quadratic backtracking on invalid URI
https://hackerone.com/reports/1444501
1 parent 72f2271 commit d829f16

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

test/uri/test_common.rb

+11
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,17 @@ def test_kernel_uri
112112
assert_raise(NoMethodError) { Object.new.URI("http://www.ruby-lang.org/") }
113113
end
114114

115+
def test_parse_timeout
116+
pre = ->(n) {
117+
'https://example.com/dir/' + 'a' * (n * 100) + '/##.jpg'
118+
}
119+
assert_linear_performance((1..10).map {|i| i * 100}, pre: pre) do |uri|
120+
assert_raise(URI::InvalidURIError) do
121+
URI.parse(uri)
122+
end
123+
end
124+
end
125+
115126
def test_encode_www_form_component
116127
assert_equal("%00+%21%22%23%24%25%26%27%28%29*%2B%2C-.%2F09%3A%3B%3C%3D%3E%3F%40" \
117128
"AZ%5B%5C%5D%5E_%60az%7B%7C%7D%7E",

0 commit comments

Comments
 (0)