[ruby/time] Fix quadratic backtracking on invalid time

https://hackerone.com/reports/1485501 https://github.com/ruby/time/commit/2444456fc1
2022-11-29 16:22:15 +09:00 · 2022-11-29 16:22:15 +09:00 · aa3885501f
commit aa3885501f
parent 623027bf0b
1 changed files with 2 additions and 2 deletions
--- a/lib/time.rb
+++ b/lib/time.rb
@ -509,8 +509,8 @@ class Time
          (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+
          (\d{2,})\s+
          (\d{2})\s*
-          :\s*(\d{2})\s*
-          (?::\s*(\d{2}))?\s+
+          :\s*(\d{2})
+          (?:\s*:\s*(\d{2}))?\s+
          ([+-]\d{4}|
           UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date
        # Since RFC 2822 permit comments, the regexp has no right anchor.