Merge pull request #600 from ooooooo-q/master

fix ReDoS
ruby-i18n · Jan 26, 2022 · d763372 · d763372
2 parents b48b0bc + af5617c
commit d763372
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/i18n/interpolate/ruby.rb b/lib/i18n/interpolate/ruby.rb
@@ -5,7 +5,7 @@ module I18n
   DEFAULT_INTERPOLATION_PATTERNS = [
     /%%/,
     /%\{([\w|]+)\}/,                            # matches placeholders like "%{foo} or %{foo|word}"
-    /%<(\w+)>(.*?\d*\.?\d*[bBdiouxXeEfgGcps])/  # matches placeholders like "%<foo>.d"
+    /%<(\w+)>([^\d]*?\d*\.?\d*[bBdiouxXeEfgGcps])/  # matches placeholders like "%<foo>.d"
   ].freeze
   INTERPOLATION_PATTERN = Regexp.union(DEFAULT_INTERPOLATION_PATTERNS)
   deprecate_constant :INTERPOLATION_PATTERN