From ba11a31c5605d185c6b75131f8801a4926b32510 Mon Sep 17 00:00:00 2001 From: Geoff Harcourt Date: Wed, 21 Feb 2024 10:02:38 -0500 Subject: [PATCH] Use Regexp#match? over String#=~ when testing for null bytes https://github.com/fastruby/fast-ruby#regexp-vs-regexpmatch-vs-regexpmatch-vs-stringmatch-vs-string-vs-stringmatch-code- This change updates the null byte checking in the included `exception` strategy to scan for null bytes with `Regexp#match?`. It appears this will be 2.5x faster when parsing the data, which might be helpful given the overhead of running this on every request. Co-authored-by: David Runger --- lib/rack/utf8_sanitizer.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rack/utf8_sanitizer.rb b/lib/rack/utf8_sanitizer.rb index 6cb5c39..c5b7dd0 100644 --- a/lib/rack/utf8_sanitizer.rb +++ b/lib/rack/utf8_sanitizer.rb @@ -49,7 +49,7 @@ def call(env) input. force_encoding(Encoding::ASCII_8BIT). encode!(Encoding::UTF_8) - if sanitize_null_bytes && input =~ NULL_BYTE_REGEX + if sanitize_null_bytes && NULL_BYTE_REGEX.match?(input) raise NullByteInString end input