Skip to content

False positive for Ruby ReDos, without version check #21218

@corsonknowles

Description

@corsonknowles

Description of the false positive

ReDos Regex alert incorrectly flags on Ruby versions > 3.2

The docs acknowledge this, but scanning is not checking versions.
https://codeql.github.com/codeql-query-help/ruby/rb-redos/

Ruby 3.2 is EOL in March.

See investigation PR of fix for false positive:

CodeQL source:
https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-1333/ReDoS.ql
https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql

URL to the alert on GitHub code scanning (optional)
https://github.com/dependabot/dependabot-core/runs/61390123956

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions