From 3fc6249bebe0301128140dbd64e57a4ca0f58b5f Mon Sep 17 00:00:00 2001 From: Benoit Daloze Date: Tue, 13 Jan 2026 10:54:56 +0100 Subject: [PATCH] Match more strictly with \A and \z --- generate-windows-versions.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/generate-windows-versions.rb b/generate-windows-versions.rb index 08b2625..1969701 100644 --- a/generate-windows-versions.rb +++ b/generate-windows-versions.rb @@ -8,20 +8,20 @@ require 'json' # - Each path component must begin with [\w], or a more restrictive character set. # - Percent (`%`) shall not be allowed to avoid any percent encoding. WINDOWS_VERSIONS_URLS_REGEXPS = [ - %r{^https://github\.com/oneclick/rubyinstaller2?/releases/download/\w[\w.-]*/\w[\w.-]*$}, - %r{^https://github\.com/MSP-Greg/ruby-loco/releases/download/\w[\w.-]*/\w[\w.-]*$} + %r{\Ahttps://github\.com/oneclick/rubyinstaller2?/releases/download/\w[\w.-]*/\w[\w.-]*\z}, + %r{\Ahttps://github\.com/MSP-Greg/ruby-loco/releases/download/\w[\w.-]*/\w[\w.-]*\z} ].freeze WINDOWS_TOOLCHAIN_VERSIONS_URLS_REGEXPS = [ - %r{^https://github\.com/oneclick/rubyinstaller/releases/download/devkit-4\.7\.2/DevKit-mingw64-64-4\.7\.2-20130224-1432-sfx\.exe$}, - %r{^https://github\.com/ruby/setup-msys2-gcc/releases/download/\w[\w.-]*/\w[\w@.-]*$}, - %r{^https://github\.com/ruby/setup-msys2-gcc/releases/latest/download/\w[\w@.-]*$} + %r{\Ahttps://github\.com/oneclick/rubyinstaller/releases/download/devkit-4\.7\.2/DevKit-mingw64-64-4\.7\.2-20130224-1432-sfx\.exe\z}, + %r{\Ahttps://github\.com/ruby/setup-msys2-gcc/releases/download/\w[\w.-]*/\w[\w@.-]*\z}, + %r{\Ahttps://github\.com/ruby/setup-msys2-gcc/releases/latest/download/\w[\w@.-]*\z} ].freeze # Validate all the URLs in the versions json def validate(versions, allowed_urls_regexps) versions.values.flat_map(&:values).each do |url| - if allowed_urls_regexps.none? { |regexp| regexp =~ url } + if allowed_urls_regexps.none? { |regexp| regexp.match? url } raise SecurityError, "Unexpected URL: #{url}" end end