feedjira 4.0.1 → 4.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7c43633bb85f7aa16a1930ba863d404bee83de5365676c1df4600df5640d4d6
-  data.tar.gz: e910be45a7e47e55cec3d4d09e219d6d245834da7360d22338c6380e1bad42ac
+  metadata.gz: 3f87fde64ce148ec9ebbd1da344070d1e9bb381904b377e030d9aae56b602aa3
+  data.tar.gz: 82282b9e5c0b03acd93b5a7e11f697793ef1d2bd34014178fcde7f632d3259ec
 SHA512:
-  metadata.gz: a1fbf835d1ae58a7a542fc37362e7c8d1fa9ab5ec435075da34f7a386aac5d0a2acda1e8d24f4138b50ca410582e5fec48409ecf6bcdf93cc2a6f8f6dee55882
-  data.tar.gz: 0ec37861fc3fac82ce93a41df4b84a3800a3a74090f17b5b6322e35c1189e63d83671d0deeca6847bb25803118f9e406c067b1e1363f863edce788b9b985130d
+  metadata.gz: 83b305a7cd33379b384ef8fe60928ba02cf7f64b0f49793d989c2a37a61ebf4a70d424b15709bd4b441de1b6bb2e170db1b646e590998bd31279b599d238fbc1
+  data.tar.gz: ae3c9076b1ae95dd943be0e4903ceaade5c955dde3a8af6bb45b8da9e94390b5a0a4607e469537a090246762febd4dcb68da8c56659cacf198da8db79af4a585

data/.rubocop.yml

@@ -60,3 +60,6 @@ RSpec/RepeatedExample:
   Enabled: false
 
 Style/Copyright: { Enabled: false }
+
+Style/HashLookupMethod:
+  Enabled: false

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Feedjira Changelog
 
+## 4.0.3
+
+* Security: stop loading external entities declared in a feed's DOCTYPE when
+  parsing with the Nokogiri handler (GHSA-frpm-47cm-rg8f)
+
+## 4.0.2
+
+* Fix ITunesRSS.able_to_parse? false positive on CDATA content (#570)
+
 ## 4.0.1
 
 * Amend Atom parser able_to_parse regex to also match the HTTPS variant of the xmlns attribute value (#558)

data/Gemfile

@@ -4,18 +4,18 @@ source "https://rubygems.org/"
 
 gemspec
 
-gem "faraday", "~> 2.13.4"
-gem "pry", "~> 0.15.0"
+gem "faraday", "~> 2.15.0"
+gem "pry", "~> 0.16.0"
 gem "rspec", "~> 3.13.0"
-gem "rubocop", "~> 1.80.0"
-gem "rubocop-performance", "~> 1.25.0"
+gem "rubocop", "~> 1.92.0"
+gem "rubocop-performance", "~> 1.27.0"
 gem "rubocop-rake", "~> 0.7.1"
-gem "rubocop-rspec", "~> 3.6.0"
+gem "rubocop-rspec", "~> 3.10.2"
 gem "simplecov", "~> 0.22.0"
 gem "yard", "~> 0.9.34"
 
 group :test do
   gem "oga", "~> 3.4"
   gem "ox", "~> 2.14.17", platforms: %i[mri rbx]
-  gem "rake", "~> 13.3.0"
+  gem "rake", "~> 13.4.2"
 end

data/Rakefile

@@ -14,7 +14,7 @@ RuboCop::RakeTask.new(:rubocop) do |t|
 end
 
 YARD::Rake::YardocTask.new do |t|
-  t.files   = ["lib/**/*.rb", "-", "LICENSE"]
+  t.files = ["lib/**/*.rb", "-", "LICENSE"]
 end
 
 task default: %i[spec rubocop]

data/lib/feedjira/feed_entry_utilities.rb

@@ -19,11 +19,10 @@ module Feedjira
     ##
     # Returns the id of the entry or its url if not id is present, as some
     # formats don't support it
-    # rubocop:disable Naming/MemoizedInstanceVariableName
+    # rubocop:disable-next Naming/MemoizedInstanceVariableName
     def id
       @entry_id ||= @url
     end
-    # rubocop:enable Naming/MemoizedInstanceVariableName
 
     ##
     # Writer for published. By default, we keep the "oldest" publish time found.

data/lib/feedjira/feed_utilities.rb

@@ -58,7 +58,7 @@ module Feedjira
 
     def update_from_feed(feed)
       self.new_entries += find_new_entries_for(feed)
-      entries.unshift(*self.new_entries)
+      entries.unshift(*new_entries)
 
       @updated = false
 

data/lib/feedjira/parser/atom_google_alerts.rb

@@ -15,7 +15,7 @@ module Feedjira
       elements :entry, as: :entries, class: AtomGoogleAlertsEntry
 
       def self.able_to_parse?(xml)
-        Atom.able_to_parse?(xml) && (%r{<id>tag:google\.com,2005:[^<]+/com\.google/alerts/} === xml) # rubocop:disable Style/CaseEquality
+        Atom.able_to_parse?(xml) && (%r{<id>tag:google\.com,2005:[^<]+/com\.google/alerts/} === xml)
       end
 
       def self.preprocess(xml)

data/lib/feedjira/parser/itunes_rss.rb

@@ -63,7 +63,8 @@ module Feedjira
       elements :item, as: :entries, class: ITunesRSSItem
 
       def self.able_to_parse?(xml)
-        %r{xmlns:itunes\s?=\s?["']http://www\.itunes\.com/dtds/podcast-1\.0\.dtd["']}i =~ xml
+        xml_without_cdata = xml.gsub(/<!\[CDATA\[.*?\]\]>/m, "")
+        %r{xmlns:itunes\s?=\s?["']http://www\.itunes\.com/dtds/podcast-1\.0\.dtd["']}i =~ xml_without_cdata
       end
     end
   end

data/lib/feedjira/rss_entry_utilities.rb

@@ -2,7 +2,7 @@
 
 module Feedjira
   module RSSEntryUtilities
-    # rubocop:todo Metrics/MethodLength
+    # rubocop:todo-next Metrics/MethodLength
     def self.included(mod) # rubocop:todo Metrics/AbcSize, Metrics/MethodLength
       mod.class_exec do
         element :title
@@ -40,7 +40,6 @@ module Feedjira
         elements :category, as: :categories
       end
     end
-    # rubocop:enable Metrics/MethodLength
 
     def entry_id
       @entry_id&.guid

data/lib/feedjira/sax_nokogiri_handler_patch.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "sax-machine/handlers/sax_nokogiri_handler"
+
+module Feedjira
+  # sax-machine's Nokogiri handler turns on entity replacement, which makes
+  # libxml2 load external entities declared in a feed's DOCTYPE (XXE). This
+  # parses with Nokogiri's default instead, which still decodes predefined
+  # entities, character references, and internal entities in text.
+  module SAXNokogiriHandlerPatch
+    # Parse without entity replacement so external entities are never loaded.
+    def sax_parse(xml_input)
+      ::Nokogiri::XML::SAX::Parser.new(self).parse(xml_input)
+    end
+
+    # Without entity replacement, libxml2 returns "&" in attribute values as
+    # "&", so we turn it back into "&".
+    def start_element(name, attrs = [])
+      super(name, attrs.map { |key, value| [key, value.gsub("&", "&")] })
+    end
+  end
+end
+
+::SAXMachine::SAXNokogiriHandler.prepend(::Feedjira::SAXNokogiriHandlerPatch)

data/lib/feedjira/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Feedjira
-  VERSION = "4.0.1"
+  VERSION = "4.0.3"
 end

data/lib/feedjira.rb

@@ -6,6 +6,7 @@ require "loofah"
 require "logger"
 require "json"
 
+require_relative "feedjira/sax_nokogiri_handler_patch"
 require_relative "feedjira/util"
 require_relative "feedjira/util/parse_time"
 require_relative "feedjira/configuration"
@@ -44,7 +45,8 @@ require_relative "feedjira/parser/json_feed_item"
 
 # Feedjira
 module Feedjira
-  NoParserAvailable = Class.new(StandardError)
+  class NoParserAvailable < StandardError
+  end
 
   extend Configuration
 

data/spec/feedjira/parser/atom_spec.rb

@@ -133,10 +133,10 @@ module Feedjira
         feed = Atom.parse sample_atom_xhtml_feed
         entry = feed.entries.first
 
-        expect(entry.raw_title).to match(/<i/)
+        expect(entry.raw_title).to include("<i")
         expect(entry.title).to eq("Sentry Calming Collar for dogs")
         expect(entry.title_type).to eq("xhtml")
-        expect(entry.summary).to match(/<b/)
+        expect(entry.summary).to include("<b")
         expect(entry.content).to match(/\A<p/)
       end
 

data/spec/feedjira/parser/itunes_rss_spec.rb

@@ -24,6 +24,10 @@ module Feedjira
       it "returns false for an rss feedburner feed" do
         expect(ITunesRSS).not_to be_able_to_parse(sample_rss_feed_burner_feed)
       end
+
+      it "returns false for an atom feed with xmlns:itunes inside CDATA" do
+        expect(ITunesRSS).not_to be_able_to_parse(sample_atom_with_itunes_in_cdata)
+      end
     end
 
     describe "parsing" do

data/spec/feedjira/preprocessor_spec.rb

@@ -17,8 +17,8 @@ describe Feedjira::Preprocessor do
     escaped = processor.to_xml
     escaped_parts = escaped.split "\n"
 
-    expect(escaped_parts[10]).to match(%r{<i>dogs</i>}) # title
-    expect(escaped_parts[16]).to match(%r{<b>XHTML</b>}) # summary
+    expect(escaped_parts[10]).to include("<i>dogs</i>") # title
+    expect(escaped_parts[16]).to include("<b>XHTML</b>") # summary
     expect(escaped_parts[26]).to match(/<p>$/) # content
   end
 

data/spec/feedjira/sax_nokogiri_handler_patch_spec.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "tempfile"
+
+::RSpec.describe(::Feedjira::SAXNokogiriHandlerPatch) do
+  around do |example|
+    original_handler = ::SAXMachine.handler
+    ::SAXMachine.handler = :nokogiri
+    example.run
+  ensure
+    ::SAXMachine.handler = original_handler
+  end
+
+  def rss_with_entry(title: "Title", link: "https://example.com", doctype: "")
+    <<~XML
+      <?xml version="1.0"?>
+      #{doctype}
+      <rss version="2.0">
+        <channel>
+          <title>Feed</title>
+          <item>
+            <title>#{title}</title>
+            <enclosure url="#{link}" type="audio/mpeg"/>
+          </item>
+        </channel>
+      </rss>
+    XML
+  end
+
+  it "does not load external entities" do
+    secret = ::Tempfile.new
+    secret.write("secret contents")
+    secret.flush
+    doctype = %(<!DOCTYPE rss [<!ENTITY file SYSTEM "file://#{secret.path}">]>)
+
+    feed = ::Feedjira.parse(rss_with_entry(title: "&file;", doctype:))
+
+    expect(feed.entries.first.title.to_s).not_to(include("secret contents"))
+  ensure
+    secret.close!
+  end
+
+  it "decodes predefined entities and character references in text" do
+    feed = ::Feedjira.parse(rss_with_entry(title: "a &amp; b &lt; c &#8217;"))
+
+    expect(feed.entries.first.title).to(eq("a & b < c ’"))
+  end
+
+  it "expands internal entities in text" do
+    doctype = '<!DOCTYPE rss [<!ENTITY co "Acme Inc">]>'
+
+    feed = ::Feedjira.parse(rss_with_entry(title: "by &co;", doctype:))
+
+    expect(feed.entries.first.title).to(eq("by Acme Inc"))
+  end
+
+  it "decodes ampersands in attribute values" do
+    xml = rss_with_entry(link: "https://example.com/?a=1&amp;b=2&amp;c=&amp;#38;")
+
+    feed = ::Feedjira.parse(xml, parser: ::Feedjira::Parser::ITunesRSS)
+
+    expect(feed.entries.first.enclosure_url).to(eq("https://example.com/?a=1&b=2&c=&#38;"))
+  end
+end

data/spec/feedjira_spec.rb

@@ -155,6 +155,12 @@ RSpec.describe Feedjira do
       expect(actual_parser).to eq described_class::Parser::ITunesRSS
     end
 
+    it "with an atom feed containing xmlns:itunes in CDATA it returns the Atom parser" do
+      xml = sample_atom_with_itunes_in_cdata
+      actual_parser = described_class.parser_for_xml(xml)
+      expect(actual_parser).to eq described_class::Parser::Atom
+    end
+
     context "when parsers are configured" do
       it "does not use default parsers" do
         xml = "Atom asdf"

data/spec/sample_feeds/AtomWithITunesInCDATA.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+  <title>Test Blog</title>
+  <link rel="alternate" href="https://example.com/" />
+  <id>tag:example.com,2024:blog</id>
+  <updated>2024-01-01T00:00:00Z</updated>
+  <entry>
+    <title>How to set up a podcast RSS feed</title>
+    <link href="https://example.com/post/1" />
+    <id>tag:example.com,2024:post-1</id>
+    <published>2024-01-01T00:00:00Z</published>
+    <content type="html"><![CDATA[
+      <p>Here is an example RSS feed:</p>
+      <pre><code>&lt;rss version="2.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd"&gt;</code></pre>
+    ]]></content>
+  </entry>
+</feed>

data/spec/sample_feeds.rb

@@ -37,7 +37,8 @@ module SampleFeeds
     sample_invalid_date_format_feed: "InvalidDateFormat.xml",
     sample_rss_feed_permalinks: "Permalinks.xml",
     sample_rss_feed_with_a10_namespace: "a10.xml",
-    sample_rss_feed_with_comments: "RSSWithComments.xml"
+    sample_rss_feed_with_comments: "RSSWithComments.xml",
+    sample_atom_with_itunes_in_cdata: "AtomWithITunesInCDATA.xml"
   }.freeze
 
   FEEDS.each do |method, filename|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: feedjira
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.0.3
 platform: ruby
 authors:
 - Adam Hess
@@ -127,6 +127,7 @@ files:
 - lib/feedjira/parser/rss_image.rb
 - lib/feedjira/preprocessor.rb
 - lib/feedjira/rss_entry_utilities.rb
+- lib/feedjira/sax_nokogiri_handler_patch.rb
 - lib/feedjira/util.rb
 - lib/feedjira/util/parse_time.rb
 - lib/feedjira/version.rb
@@ -157,6 +158,7 @@ files:
 - spec/feedjira/parser/rss_feed_burner_spec.rb
 - spec/feedjira/parser/rss_spec.rb
 - spec/feedjira/preprocessor_spec.rb
+- spec/feedjira/sax_nokogiri_handler_patch_spec.rb
 - spec/feedjira/util/parse_time_spec.rb
 - spec/feedjira_spec.rb
 - spec/sample_feeds.rb
@@ -164,6 +166,7 @@ files:
 - spec/sample_feeds/AmazonWebServicesBlogFirstEntryContent.xml
 - spec/sample_feeds/AtomEscapedHTMLInPreTag.xml
 - spec/sample_feeds/AtomFeedWithSpacesAroundEquals.xml
+- spec/sample_feeds/AtomWithITunesInCDATA.xml
 - spec/sample_feeds/CRE.xml
 - spec/sample_feeds/DuplicateContentAtomFeed.xml
 - spec/sample_feeds/FeedBurnerUrlNoAlternate.xml
@@ -226,7 +229,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A feed parsing library
 test_files: []