openapi-generator
openapi-generator copied to clipboard
[BUG][Ruby] CodeQL: Polynomial regular expression
Bug Report Checklist
- [X] Have you provided a full/minimal spec to reproduce the issue? https://github.com/onfido/onfido-openapi-spec/blob/master/generated/artifacts/openapi-reference/openapi.json
- [X] Have you validated the input using an OpenAPI validator (example)?
- [ ] Have you tested with the latest master to confirm the issue still exists?
- [X] Have you searched for related issues/PRs?
- [X] What's the actual output vs expected output? No alert raised.
- [ ] [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description
Running CodeQL raises 2 alerts like:
Polynomial regular expression used on uncontrolled data
https://codeql.github.com/codeql-query-help/ruby/rb-polynomial-redos/
openapi-generator version
7.5.0
OpenAPI declaration file content or url
N/A
Generation Details
inputSpec: openapi.yaml
generatorName: ruby
library: "faraday"
templateDir: generators/ruby/faraday/templates
outputDir: generated/artifacts/ruby/faraday
disallowAdditionalPropertiesIfNotPresent: false
enumUnknownDefaultCase: true
gemName: onfido
gemHomepage: https://github.com/onfido/onfido-ruby
gemLicense: MIT
gemSummary: The official Ruby library for integrating with the Onfido API.
gemDescription: Ruby Library for the Onfido API
httpUserAgent: onfido-ruby/2.9.0
Steps to reproduce
Run CodeQL in Github on generated ruby code with faraday library.
Related issues/PRs
N/A
Suggest a fix
Update the two regex:
- https://github.com/OpenAPITools/openapi-generator/blob/master/modules/openapi-generator/src/main/resources/ruby-client/api_client.mustache#L145-L147
- https://github.com/OpenAPITools/openapi-generator/blob/master/modules/openapi-generator/src/main/resources/ruby-client/api_client.mustache#L66-L68