Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SECURITY: use rstrip instead of regex gsub to prevent ReDOS (#19737) 

`rstrip` implementation is much more performant than regex

Co-authored-by: Krzysztof Kotlarek <kotlarek.krzysztof@gmail.com>
This commit is contained in:
Alan Guo Xiang Tan 2023-01-05 06:09:17 +08:00 committed by GitHub
parent 83944213b2
commit 918dd4d635
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/post_creator.rb
View File

@ -514,7 +514,7 @@ class PostCreator
end end
def setup_post def setup_post
@opts[:raw] = TextCleaner.normalize_whitespaces(@opts[:raw] || '').gsub(/\s+\z/, "") @opts[:raw] = TextCleaner.normalize_whitespaces(@opts[:raw] || '').rstrip
post = Post.new(raw: @opts[:raw], post = Post.new(raw: @opts[:raw],
topic_id: @topic.try(:id), topic_id: @topic.try(:id),

2
lib/post_revisor.rb
View File

@ -274,7 +274,7 @@ class PostRevisor
end end
def cleanup_whitespaces(raw) def cleanup_whitespaces(raw)
raw.present? ? TextCleaner.normalize_whitespaces(raw).gsub(/\s+\z/, "") : "" raw.present? ? TextCleaner.normalize_whitespaces(raw).rstrip : ""
end end
def should_revise? def should_revise?