GMS-2023-3722: encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

Impact

The length of URIs and the various parts (eg path segments, query parameters) is usually limited by the webserver processing the incoming request. In the case of Puma the defaults are :

• path segment length: 8192
• Max URI length: 1024 * 12
• Max query length: 1024 * 10

See https://github.com/puma/puma/blob/master/docs/compile_options.md

If too long Puma raises:

Puma caught this error: HTTP element REQUEST_PATH is longer than the (8192) allowed length (was 12503) (Puma::HttpParserError)

However due to the performance of hashids extremely long encoded IDs will consume a large amount of CPU and allocate a huge number of intermediate objects.

For example:

curl -vvv https://localhost.ssl:3000//dos?id=abcd-<'a' * 10077>

This causes the application to spend a huge amount of time decoding the ID and the allocation of > 200MB of objects.

Patches

Upgrade to 1.0.0.beta2

This introduces a new option to limit the length of IDs that can be decoded. A future release will also improve the performance and hugely reduce allocations in the underlying hashids implementation.