openapi-generator icon indicating copy to clipboard operation
openapi-generator copied to clipboard

[BUG][Ruby] CodeQL: Polynomial regular expression

Open RiccardoPetteruti opened this issue 1 year ago • 0 comments

Bug Report Checklist

  • [X] Have you provided a full/minimal spec to reproduce the issue? https://github.com/onfido/onfido-openapi-spec/blob/master/generated/artifacts/openapi-reference/openapi.json
  • [X] Have you validated the input using an OpenAPI validator (example)?
  • [ ] Have you tested with the latest master to confirm the issue still exists?
  • [X] Have you searched for related issues/PRs?
  • [X] What's the actual output vs expected output? No alert raised.
  • [ ] [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description

Running CodeQL raises 2 alerts like: Polynomial regular expression used on uncontrolled data

https://codeql.github.com/codeql-query-help/ruby/rb-polynomial-redos/

image

openapi-generator version

7.5.0

OpenAPI declaration file content or url

N/A

Generation Details
inputSpec: openapi.yaml
generatorName: ruby
library: "faraday"
templateDir: generators/ruby/faraday/templates
outputDir: generated/artifacts/ruby/faraday
disallowAdditionalPropertiesIfNotPresent: false
enumUnknownDefaultCase: true
gemName: onfido
gemHomepage: https://github.com/onfido/onfido-ruby
gemLicense: MIT
gemSummary: The official Ruby library for integrating with the Onfido API.
gemDescription: Ruby Library for the Onfido API
httpUserAgent: onfido-ruby/2.9.0
Steps to reproduce

Run CodeQL in Github on generated ruby code with faraday library.

Related issues/PRs

N/A

Suggest a fix

Update the two regex:

  • https://github.com/OpenAPITools/openapi-generator/blob/master/modules/openapi-generator/src/main/resources/ruby-client/api_client.mustache#L145-L147
  • https://github.com/OpenAPITools/openapi-generator/blob/master/modules/openapi-generator/src/main/resources/ruby-client/api_client.mustache#L66-L68

PR link

RiccardoPetteruti avatar May 17 '24 12:05 RiccardoPetteruti