Skip to content

Commit

Permalink
fix: update json_mime logic to prevent ReDoS issues (#20)
Browse files Browse the repository at this point in the history
  • Loading branch information
carlosmmatos authored Jul 20, 2023
1 parent 939fc38 commit de40575
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion lib/crimson-falcon/api_client.rb
Original file line number Diff line number Diff line change
Expand Up @@ -359,9 +359,17 @@ def download_file(request)
# @param [String] mime MIME
# @return [Boolean] True if the MIME is application/json
def json_mime?(mime)
(mime == "*/*") || !(mime =~ /Application\/.*json(?!p)(;.*)?/i).nil?
mime = mime.downcase
return true if mime == '*/*'

mime_type, subtype = mime.split('/')
return false unless mime_type == 'application'

subtype_main = subtype.split(';').first
subtype_main == 'json' || subtype_main == 'jsonp'
end


# Deserialize the response to the given return type.
#
# @param [Response] response HTTP response
Expand Down

0 comments on commit de40575

Please sign in to comment.