Fix quadratic backtracking on invalid time

https://hackerone.com/reports/1485501
ruby · Mar 24, 2023 · b57db51 · b57db51
1 parent c9b92a6
commit b57db51
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/lib/time.rb b/lib/time.rb
@@ -509,8 +509,8 @@ def rfc2822(date)
           (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+
           (\d{2,})\s+
           (\d{2})\s*
-          :\s*(\d{2})\s*
-          (?::\s*(\d{2}))?\s+
+          :\s*(\d{2})
+          (?:\s*:\s*(\d{2}))?\s+
           ([+-]\d{4}|
            UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date
         # Since RFC 2822 permit comments, the regexp has no right anchor.