Question: how to deal with Regexp::Timeout in _decode_uri_component?

lib/uri/common.rb の参照されている _decode_uri_component パスから始め、大きなパーセントエンコード済みペイロードで Regexp::TimeoutError を再現します。maintainers と望ましい URI の動作について議論して定義し、その後 timeout のケースのカバレッジを追加して、選択したアプローチが報告された入力を処理できることを確認します。

Hi folks, thanks for maintaining the URI gem!

I faced the following issue with a 65MB mime-body payload and over 13 million percent-encoded characters:

Regexp::TimeoutError POST /rails/action_mailbox/mailgun/inbound_emails/mime

vendor/bundle/ruby/3.3.0/gems/uri-0.13.3/lib/uri/common.rb:400:in `match?': regexp match timeout (Regexp::TimeoutError)
    from vendor/bundle/ruby/3.3.0/gems/uri-0.13.3/lib/uri/common.rb:400:in `_decode_uri_component'

Ref:

• https://github.com/ruby/uri/blob/v0.13.3/lib/uri/common.rb#L400
• https://github.com/ruby/uri/blob/v1.1.1/lib/uri/common.rb#L464

My workaround was to monkey patch the decode_www_form_component to avoid the Regexp code path if it times out:

module URIFormComponentLinearDecode
  ORIGINAL_DECODE_WWW_FORM_COMPONENT = URI.method(:decode_www_form_component)

  DECODE_TABLE = URI.const_get(:TBLDECWWWCOMP_)

  def decode_www_form_component(str, enc = Encoding::UTF_8)
    ORIGINAL_DECODE_WWW_FORM_COMPONENT.call(str, enc)
  rescue Regexp::TimeoutError
    raise unless str.is_a?(String)

    Rails.logger.info("[URIFormComponentLinearDecode] bytesize=#{str.bytesize}")

    linear_decode_www_form_component(str, enc)
  end

  private

  def linear_decode_www_form_component(str, enc)
    source = str.b
    output = String.new(capacity: source.bytesize).b
    index = 0

    while index < source.bytesize
      byte = source.getbyte(index)

      case byte
      when 37 # "%"
        raise ArgumentError, "invalid %-encoding (#{str})" unless index + 2 < source.bytesize

        encoded = source.byteslice(index, 3)
        decoded = DECODE_TABLE[encoded]

        raise ArgumentError, "invalid %-encoding (#{str})" unless decoded

        output << decoded
        index += 3
      when 43 # "+"
        output << DECODE_TABLE["+"]
        index += 1
      else
        output << byte
        index += 1
      end
    end

    output.force_encoding(enc)
  end
end

URI.singleton_class.prepend(URIFormComponentLinearDecode)

I was wondering:

• Did you guys face this problem before?
• Do you have a better approach to it?
• Do you think a solution to this issue belongs in the URI codebase?
• Do you think it would make sense to use a native function in this case?

I'm happy to contribute with a PR if you would like me to. Please let me know if you have any thoughts.

Thanks.