brakeman 4.7.1 → 5.2.1

data/bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md

@@ -0,0 +1,178 @@
+# News
+
+## 3.2.5 - 2021-04-05 {#version-3-2-5}
+
+### Improvements
+
+  * Add more validations to XPath parser.
+
+  * `require "rexml/docuemnt"` by default.
+    [GitHub#36][Patch by Koichi ITO]
+
+  * Don't add `#dcloe` method to core classes globally.
+    [GitHub#37][Patch by Akira Matsuda]
+
+  * Add more documentations.
+    [Patch by Burdette Lamar]
+
+  * Added `REXML::Elements#parent`.
+    [GitHub#52][Patch by Burdette Lamar]
+
+### Fixes
+
+  * Fixed a bug that `REXML::DocType#clone` doesn't copy external ID
+    information.
+
+  * Fixed round-trip vulnerability bugs.
+    See also: https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/
+    [HackerOne#1104077][CVE-2021-28965][Reported by Juho Nurminen]
+
+### Thanks
+
+  * Koichi ITO
+
+  * Akira Matsuda
+
+  * Burdette Lamar
+
+  * Juho Nurminen
+
+## 3.2.4 - 2020-01-31 {#version-3-2-4}
+
+### Improvements
+
+  * Don't use `taint` with Ruby 2.7 or later.
+    [GitHub#21][Patch by Jeremy Evans]
+
+### Fixes
+
+  * Fixed a `elsif` typo.
+    [GitHub#22][Patch by Nobuyoshi Nakada]
+
+### Thanks
+
+  * Jeremy Evans
+
+  * Nobuyoshi Nakada
+
+## 3.2.3 - 2019-10-12 {#version-3-2-3}
+
+### Fixes
+
+  * Fixed a bug that `REXML::XMLDecl#close` doesn't copy `@writethis`.
+    [GitHub#20][Patch by hirura]
+
+### Thanks
+
+  * hirura
+
+## 3.2.2 - 2019-06-03 {#version-3-2-2}
+
+### Fixes
+
+  * xpath: Fixed a bug for equality and relational expressions.
+    [GitHub#17][Reported by Mirko Budszuhn]
+
+  * xpath: Fixed `boolean()` implementation.
+
+  * xpath: Fixed `local_name()` with nonexistent node.
+
+  * xpath: Fixed `number()` implementation with node set.
+    [GitHub#18][Reported by Mirko Budszuhn]
+
+### Thanks
+
+  * Mirko Budszuhn
+
+## 3.2.1 - 2019-05-04 {#version-3-2-1}
+
+### Improvements
+
+  * Improved error message.
+    [GitHub#12][Patch by FUJI Goro]
+
+  * Improved error message.
+    [GitHub#16][Patch by ujihisa]
+
+  * Improved documentation markup.
+    [GitHub#14][Patch by Alyssa Ross]
+
+### Fixes
+
+  * Fixed a bug that `nil` variable value raises an unexpected exception.
+    [GitHub#13][Patch by Alyssa Ross]
+
+### Thanks
+
+  * FUJI Goro
+
+  * Alyssa Ross
+
+  * ujihisa
+
+## 3.2.0 - 2019-01-01 {#version-3-2-0}
+
+### Fixes
+
+  * Fixed a bug that no namespace attribute isn't matched with prefix.
+
+    [ruby-list:50731][Reported by Yasuhiro KIMURA]
+
+  * Fixed a bug that the default namespace is applied to attribute names.
+
+    NOTE: It's a backward incompatible change. If your program has any
+    problem with this change, please report it. We may revert this fix.
+
+    * `REXML::Attribute#prefix` returns `""` for no namespace attribute.
+
+    * `REXML::Attribute#namespace` returns `""` for no namespace attribute.
+
+### Thanks
+
+  * Yasuhiro KIMURA
+
+## 3.1.9 - 2018-12-20 {#version-3-1-9}
+
+### Improvements
+
+  * Improved backward compatibility.
+
+    Restored `REXML::Parsers::BaseParser::UNQME_STR` because it's used
+    by kramdown.
+
+## 3.1.8 - 2018-12-20 {#version-3-1-8}
+
+### Improvements
+
+  * Added support for customizing quote character in prologue.
+    [GitHub#8][Bug #9367][Reported by Takashi Oguma]
+
+    * You can use `"` as quote character by specifying `:quote` to
+      `REXML::Document#context[:prologue_quote]`.
+
+    * You can use `'` as quote character by specifying `:apostrophe`
+      to `REXML::Document#context[:prologue_quote]`.
+
+  * Added processing instruction target check. The target must not nil.
+    [GitHub#7][Reported by Ariel Zelivansky]
+
+  * Added name check for element and attribute.
+    [GitHub#7][Reported by Ariel Zelivansky]
+
+  * Stopped to use `Exception`.
+    [GitHub#9][Patch by Jean Boussier]
+
+### Fixes
+
+  * Fixed a bug that `REXML::Text#clone` escapes value twice.
+    [ruby-dev:50626][Bug #15058][Reported by Ryosuke Nanba]
+
+### Thanks
+
+  * Takashi Oguma
+
+  * Ariel Zelivansky
+
+  * Jean Boussier
+
+  * Ryosuke Nanba

data/bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md

@@ -0,0 +1,48 @@
+# REXML
+
+REXML was inspired by the Electric XML library for Java, which features an easy-to-use API, small size, and speed. Hopefully, REXML, designed with the same philosophy, has these same features. I've tried to keep the API as intuitive as possible, and have followed the Ruby methodology for method naming and code flow, rather than mirroring the Java API.
+
+REXML supports both tree and stream document parsing. Stream parsing is faster (about 1.5 times as fast). However, with stream parsing, you don't get access to features such as XPath.
+
+## API
+
+See the {API documentation}[https://ruby.github.io/rexml/]
+
+## Usage
+
+We'll start with parsing an XML document
+
+```ruby
+require "rexml/document"
+file = File.new( "mydoc.xml" )
+doc = REXML::Document.new file
+```
+
+Line 3 creates a new document and parses the supplied file. You can also do the following
+
+```ruby
+require "rexml/document"
+include REXML  # so that we don't have to prefix everything with REXML::...
+string = <<EOF
+  <mydoc>
+    <someelement attribute="nanoo">Text, text, text</someelement>
+  </mydoc>
+EOF
+doc = Document.new string
+```
+
+So parsing a string is just as easy as parsing a file.
+
+## Development
+
+After checking out the repo, run `rake test` to run the tests.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/ruby/rexml.
+
+## License
+
+The gem is available as open source under the terms of the [BSD-2-Clause](LICENSE.txt).

data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: false
+#vim:ts=2 sw=2 noexpandtab:
+require_relative 'child'
+require_relative 'source'
+
+module REXML
+  # This class needs:
+  # * Documentation
+  # * Work!  Not all types of attlists are intelligently parsed, so we just
+  # spew back out what we get in.  This works, but it would be better if
+  # we formatted the output ourselves.
+  #
+  # AttlistDecls provide *just* enough support to allow namespace
+  # declarations.  If you need some sort of generalized support, or have an
+  # interesting idea about how to map the hideous, terrible design of DTD
+  # AttlistDecls onto an intuitive Ruby interface, let me know.  I'm desperate
+  # for anything to make DTDs more palateable.
+  class AttlistDecl < Child
+    include Enumerable
+
+    # What is this?  Got me.
+    attr_reader :element_name
+
+    # Create an AttlistDecl, pulling the information from a Source.  Notice
+    # that this isn't very convenient; to create an AttlistDecl, you basically
+    # have to format it yourself, and then have the initializer parse it.
+    # Sorry, but for the foreseeable future, DTD support in REXML is pretty
+    # weak on convenience.  Have I mentioned how much I hate DTDs?
+    def initialize(source)
+      super()
+      if (source.kind_of? Array)
+        @element_name, @pairs, @contents = *source
+      end
+    end
+
+    # Access the attlist attribute/value pairs.
+    #  value = attlist_decl[ attribute_name ]
+    def [](key)
+      @pairs[key]
+    end
+
+    # Whether an attlist declaration includes the given attribute definition
+    #  if attlist_decl.include? "xmlns:foobar"
+    def include?(key)
+      @pairs.keys.include? key
+    end
+
+    # Iterate over the key/value pairs:
+    #  attlist_decl.each { |attribute_name, attribute_value| ... }
+    def each(&block)
+      @pairs.each(&block)
+    end
+
+    # Write out exactly what we got in.
+    def write out, indent=-1
+      out << @contents
+    end
+
+    def node_type
+      :attlistdecl
+    end
+  end
+end

data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: false
+require_relative "namespace"
+require_relative 'text'
+
+module REXML
+  # Defines an Element Attribute; IE, a attribute=value pair, as in:
+  # <element attribute="value"/>.  Attributes can be in their own
+  # namespaces.  General users of REXML will not interact with the
+  # Attribute class much.
+  class Attribute
+    include Node
+    include Namespace
+
+    # The element to which this attribute belongs
+    attr_reader :element
+    # The normalized value of this attribute.  That is, the attribute with
+    # entities intact.
+    attr_writer :normalized
+    PATTERN = /\s*(#{NAME_STR})\s*=\s*(["'])(.*?)\2/um
+
+    NEEDS_A_SECOND_CHECK = /(<|&((#{Entity::NAME});|(#0*((?:\d+)|(?:x[a-fA-F0-9]+)));)?)/um
+
+    # Constructor.
+    # FIXME: The parser doesn't catch illegal characters in attributes
+    #
+    # first::
+    #   Either: an Attribute, which this new attribute will become a
+    #   clone of; or a String, which is the name of this attribute
+    # second::
+    #   If +first+ is an Attribute, then this may be an Element, or nil.
+    #   If nil, then the Element parent of this attribute is the parent
+    #   of the +first+ Attribute.  If the first argument is a String,
+    #   then this must also be a String, and is the content of the attribute.
+    #   If this is the content, it must be fully normalized (contain no
+    #   illegal characters).
+    # parent::
+    #   Ignored unless +first+ is a String; otherwise, may be the Element
+    #   parent of this attribute, or nil.
+    #
+    #
+    #  Attribute.new( attribute_to_clone )
+    #  Attribute.new( attribute_to_clone, parent_element )
+    #  Attribute.new( "attr", "attr_value" )
+    #  Attribute.new( "attr", "attr_value", parent_element )
+    def initialize( first, second=nil, parent=nil )
+      @normalized = @unnormalized = @element = nil
+      if first.kind_of? Attribute
+        self.name = first.expanded_name
+        @unnormalized = first.value
+        if second.kind_of? Element
+          @element = second
+        else
+          @element = first.element
+        end
+      elsif first.kind_of? String
+        @element = parent
+        self.name = first
+        @normalized = second.to_s
+      else
+        raise "illegal argument #{first.class.name} to Attribute constructor"
+      end
+    end
+
+    # Returns the namespace of the attribute.
+    #
+    #  e = Element.new( "elns:myelement" )
+    #  e.add_attribute( "nsa:a", "aval" )
+    #  e.add_attribute( "b", "bval" )
+    #  e.attributes.get_attribute( "a" ).prefix   # -> "nsa"
+    #  e.attributes.get_attribute( "b" ).prefix   # -> ""
+    #  a = Attribute.new( "x", "y" )
+    #  a.prefix                                   # -> ""
+    def prefix
+      super
+    end
+
+    # Returns the namespace URL, if defined, or nil otherwise
+    #
+    #  e = Element.new("el")
+    #  e.add_namespace("ns", "http://url")
+    #  e.add_attribute("ns:a", "b")
+    #  e.add_attribute("nsx:a", "c")
+    #  e.attribute("ns:a").namespace # => "http://url"
+    #  e.attribute("nsx:a").namespace # => nil
+    #
+    # This method always returns "" for no namespace attribute. Because
+    # the default namespace doesn't apply to attribute names.
+    #
+    # From https://www.w3.org/TR/xml-names/#uniqAttrs
+    #
+    # > the default namespace does not apply to attribute names
+    #
+    #  e = REXML::Element.new("el")
+    #  e.add_namespace("", "http://example.com/")
+    #  e.namespace # => "http://example.com/"
+    #  e.add_attribute("a", "b")
+    #  e.attribute("a").namespace # => ""
+    def namespace arg=nil
+      arg = prefix if arg.nil?
+      if arg == ""
+        ""
+      else
+        @element.namespace(arg)
+      end
+    end
+
+    # Returns true if other is an Attribute and has the same name and value,
+    # false otherwise.
+    def ==( other )
+      other.kind_of?(Attribute) and other.name==name and other.value==value
+    end
+
+    # Creates (and returns) a hash from both the name and value
+    def hash
+      name.hash + value.hash
+    end
+
+    # Returns this attribute out as XML source, expanding the name
+    #
+    #  a = Attribute.new( "x", "y" )
+    #  a.to_string     # -> "x='y'"
+    #  b = Attribute.new( "ns:x", "y" )
+    #  b.to_string     # -> "ns:x='y'"
+    def to_string
+      if @element and @element.context and @element.context[:attribute_quote] == :quote
+        %Q^#@expanded_name="#{to_s().gsub(/"/, '&quot;')}"^
+      else
+        "#@expanded_name='#{to_s().gsub(/'/, '&apos;')}'"
+      end
+    end
+
+    def doctype
+      if @element
+        doc = @element.document
+        doc.doctype if doc
+      end
+    end
+
+    # Returns the attribute value, with entities replaced
+    def to_s
+      return @normalized if @normalized
+
+      @normalized = Text::normalize( @unnormalized, doctype )
+      @unnormalized = nil
+      @normalized
+    end
+
+    # Returns the UNNORMALIZED value of this attribute.  That is, entities
+    # have been expanded to their values
+    def value
+      return @unnormalized if @unnormalized
+      @unnormalized = Text::unnormalize( @normalized, doctype )
+      @normalized = nil
+      @unnormalized
+    end
+
+    # Returns a copy of this attribute
+    def clone
+      Attribute.new self
+    end
+
+    # Sets the element of which this object is an attribute.  Normally, this
+    # is not directly called.
+    #
+    # Returns this attribute
+    def element=( element )
+      @element = element
+
+      if @normalized
+        Text.check( @normalized, NEEDS_A_SECOND_CHECK, doctype )
+      end
+
+      self
+    end
+
+    # Removes this Attribute from the tree, and returns true if successful
+    #
+    # This method is usually not called directly.
+    def remove
+      @element.attributes.delete self.name unless @element.nil?
+    end
+
+    # Writes this attribute (EG, puts 'key="value"' to the output)
+    def write( output, indent=-1 )
+      output << to_string
+    end
+
+    def node_type
+      :attribute
+    end
+
+    def inspect
+      rv = ""
+      write( rv )
+      rv
+    end
+
+    def xpath
+      path = @element.xpath
+      path += "/@#{self.expanded_name}"
+      return path
+    end
+  end
+end
+#vim:ts=2 sw=2 noexpandtab:

data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: false
+require_relative "text"
+
+module REXML
+  class CData < Text
+    START = '<![CDATA['
+    STOP = ']]>'
+    ILLEGAL = /(\]\]>)/
+
+    #   Constructor.  CData is data between <![CDATA[ ... ]]>
+    #
+    # _Examples_
+    #  CData.new( source )
+    #  CData.new( "Here is some CDATA" )
+    #  CData.new( "Some unprocessed data", respect_whitespace_TF, parent_element )
+    def initialize( first, whitespace=true, parent=nil )
+      super( first, whitespace, parent, false, true, ILLEGAL )
+    end
+
+    # Make a copy of this object
+    #
+    # _Examples_
+    #  c = CData.new( "Some text" )
+    #  d = c.clone
+    #  d.to_s        # -> "Some text"
+    def clone
+      CData.new self
+    end
+
+    # Returns the content of this CData object
+    #
+    # _Examples_
+    #  c = CData.new( "Some text" )
+    #  c.to_s        # -> "Some text"
+    def to_s
+      @string
+    end
+
+    def value
+      @string
+    end
+
+    # == DEPRECATED
+    # See the rexml/formatters package
+    #
+    # Generates XML output of this object
+    #
+    # output::
+    #   Where to write the string.  Defaults to $stdout
+    # indent::
+    #   The amount to indent this node by
+    # transitive::
+    #   Ignored
+    # ie_hack::
+    #   Ignored
+    #
+    # _Examples_
+    #  c = CData.new( " Some text " )
+    #  c.write( $stdout )     #->  <![CDATA[ Some text ]]>
+    def write( output=$stdout, indent=-1, transitive=false, ie_hack=false )
+      Kernel.warn( "#{self.class.name}.write is deprecated", uplevel: 1)
+      indent( output, indent )
+      output << START
+      output << @string
+      output << STOP
+    end
+  end
+end

data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: false
+require_relative "node"
+
+module REXML
+  ##
+  # A Child object is something contained by a parent, and this class
+  # contains methods to support that.  Most user code will not use this
+  # class directly.
+  class Child
+    include Node
+    attr_reader :parent         # The Parent of this object
+
+    # Constructor.  Any inheritors of this class should call super to make
+    # sure this method is called.
+    # parent::
+    #   if supplied, the parent of this child will be set to the
+    #   supplied value, and self will be added to the parent
+    def initialize( parent = nil )
+      @parent = nil
+      # Declare @parent, but don't define it.  The next line sets the
+      # parent.
+      parent.add( self ) if parent
+    end
+
+    # Replaces this object with another object.  Basically, calls
+    # Parent.replace_child
+    #
+    # Returns:: self
+    def replace_with( child )
+      @parent.replace_child( self, child )
+      self
+    end
+
+    # Removes this child from the parent.
+    #
+    # Returns:: self
+    def remove
+      unless @parent.nil?
+        @parent.delete self
+      end
+      self
+    end
+
+    # Sets the parent of this child to the supplied argument.
+    #
+    # other::
+    #   Must be a Parent object.  If this object is the same object as the
+    #   existing parent of this child, no action is taken. Otherwise, this
+    #   child is removed from the current parent (if one exists), and is added
+    #   to the new parent.
+    # Returns:: The parent added
+    def parent=( other )
+      return @parent if @parent == other
+      @parent.delete self if defined? @parent and @parent
+      @parent = other
+    end
+
+    alias :next_sibling :next_sibling_node
+    alias :previous_sibling :previous_sibling_node
+
+    # Sets the next sibling of this child.  This can be used to insert a child
+    # after some other child.
+    #  a = Element.new("a")
+    #  b = a.add_element("b")
+    #  c = Element.new("c")
+    #  b.next_sibling = c
+    #  # => <a><b/><c/></a>
+    def next_sibling=( other )
+      parent.insert_after self, other
+    end
+
+    # Sets the previous sibling of this child.  This can be used to insert a
+    # child before some other child.
+    #  a = Element.new("a")
+    #  b = a.add_element("b")
+    #  c = Element.new("c")
+    #  b.previous_sibling = c
+    #  # => <a><b/><c/></a>
+    def previous_sibling=(other)
+      parent.insert_before self, other
+    end
+
+    # Returns:: the document this child belongs to, or nil if this child
+    # belongs to no document
+    def document
+      return parent.document unless parent.nil?
+      nil
+    end
+
+    # This doesn't yet handle encodings
+    def bytes
+      document.encoding
+
+      to_s
+    end
+  end
+end