Fix quadratic backtracking on invalid time

https://hackerone.com/reports/1485501
2022-11-29 16:22:15 +09:00 · 2022-11-29 16:22:15 +09:00 · 2cb830602f
commit 2cb830602f
parent 332135b9a9
1 changed files with 2 additions and 2 deletions
--- a/lib/time.rb
+++ b/lib/time.rb
@ -501,8 +501,8 @@ class Time
          (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+
          (\d{2,})\s+
          (\d{2})\s*
-          :\s*(\d{2})\s*
-          (?::\s*(\d{2}))?\s+
+          :\s*(\d{2})
+          (?:\s*:\s*(\d{2}))?\s+
          ([+-]\d{4}|
           UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date
        # Since RFC 2822 permit comments, the regexp has no right anchor.