From 995ce947bed7e92bcda185f164d43089e6a1cf5e Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@ruby-lang.org>
Date: Sat, 22 Apr 2023 20:09:10 +0900
Subject: [ruby/uri] Fix quadratic backtracking on invalid port number

https://hackerone.com/reports/1958260

https://github.com/ruby/uri/commit/9d7bcef1e6
---
 lib/uri/rfc3986_parser.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib/uri/rfc3986_parser.rb')

diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb
index 41fbea4b03..092a1ac89d 100644
--- a/lib/uri/rfc3986_parser.rb
+++ b/lib/uri/rfc3986_parser.rb
@@ -164,7 +164,7 @@ module URI
         QUERY: %r[\A(?:%\h\h|[!$&-.0-9:;=@A-Z_a-z~/?])*+\z],
         FRAGMENT: %r[\A#{FRAGMENT}\z]o,
         OPAQUE: %r[\A(?:[^/].*)?\z],
-        PORT: /\A[\x09\x0a\x0c\x0d ]*\d*[\x09\x0a\x0c\x0d ]*\z/,
+        PORT: /\A[\x09\x0a\x0c\x0d ]*+\d*[\x09\x0a\x0c\x0d ]*\z/,
       }
     end
 
-- 
cgit v1.2.3