Ruby

Ruby line-anchor newline bypass

The following validation uses ^ and $ before passing the original input to ERB:

if user_input =~ /^[0-9a-z ]+$/i
  output = ERB.new(user_input).result(binding)
end

In Ruby, ^ and $ match the beginning and end of a line. A valid first line therefore satisfies the regex even when another line contains characters outside the allowlist.

a
<%= 7 * 7 %>

The regex matches a at offset 0, which is a truthy return value from =~. The complete user_input, including the second line, is then passed to ERB.new() and the expression renders 49.

\A and \z match the absolute beginning and end of the string:

if user_input =~ /\A[0-9a-z ]+\z/i
  output = ERB.new(user_input).result(binding)
end

The multiline input does not match the corrected expression because the second line falls outside the allowlist.

_{Find by: regex bypass, ruby regex, regexp, line anchor, multiline, newline bypass, caret dollar, start end line, absolute anchor, backslash A, backslash z, allowlist bypass, erb, ssti · Source: HTB/Neonify}