feedjira 4.0.2 → 4.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb65081b36daffe6b574820cdfba4b0e444854e8e72b3b6f6f82f2efc80befd2
-  data.tar.gz: 14d58fb668a54606e0b03e0f8f9a6748681a562902955120937f0cb6cd62c0b7
+  metadata.gz: 3f87fde64ce148ec9ebbd1da344070d1e9bb381904b377e030d9aae56b602aa3
+  data.tar.gz: 82282b9e5c0b03acd93b5a7e11f697793ef1d2bd34014178fcde7f632d3259ec
 SHA512:
-  metadata.gz: 39be37b94a2c07856bee078fa641015ce78c19336797dbf1403d731db27b6c2ab44ad834e2b691c63b9d473462e1794b228e949e7b87d7647a04c198ab514274
-  data.tar.gz: 0c9237598fd8d7cea5be2201169925d30983298b02612d2812fd1ab196337be4b5a5054eb5f58430b8a4f3bfe6465f4a8018064539bcb93779d12802d9371248
+  metadata.gz: 83b305a7cd33379b384ef8fe60928ba02cf7f64b0f49793d989c2a37a61ebf4a70d424b15709bd4b441de1b6bb2e170db1b646e590998bd31279b599d238fbc1
+  data.tar.gz: ae3c9076b1ae95dd943be0e4903ceaade5c955dde3a8af6bb45b8da9e94390b5a0a4607e469537a090246762febd4dcb68da8c56659cacf198da8db79af4a585

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Feedjira Changelog
 
+## 4.0.3
+
+* Security: stop loading external entities declared in a feed's DOCTYPE when
+  parsing with the Nokogiri handler (GHSA-frpm-47cm-rg8f)
+
 ## 4.0.2
 
 * Fix ITunesRSS.able_to_parse? false positive on CDATA content (#570)

data/Gemfile

@@ -4,18 +4,18 @@ source "https://rubygems.org/"
 
 gemspec
 
-gem "faraday", "~> 2.14.0"
+gem "faraday", "~> 2.15.0"
 gem "pry", "~> 0.16.0"
 gem "rspec", "~> 3.13.0"
-gem "rubocop", "~> 1.86.0"
-gem "rubocop-performance", "~> 1.26.0"
+gem "rubocop", "~> 1.92.0"
+gem "rubocop-performance", "~> 1.27.0"
 gem "rubocop-rake", "~> 0.7.1"
-gem "rubocop-rspec", "~> 3.9.0"
+gem "rubocop-rspec", "~> 3.10.2"
 gem "simplecov", "~> 0.22.0"
 gem "yard", "~> 0.9.34"
 
 group :test do
   gem "oga", "~> 3.4"
   gem "ox", "~> 2.14.17", platforms: %i[mri rbx]
-  gem "rake", "~> 13.3.0"
+  gem "rake", "~> 13.4.2"
 end

data/Rakefile

@@ -14,7 +14,7 @@ RuboCop::RakeTask.new(:rubocop) do |t|
 end
 
 YARD::Rake::YardocTask.new do |t|
-  t.files   = ["lib/**/*.rb", "-", "LICENSE"]
+  t.files = ["lib/**/*.rb", "-", "LICENSE"]
 end
 
 task default: %i[spec rubocop]

data/lib/feedjira/feed_entry_utilities.rb

@@ -19,11 +19,10 @@ module Feedjira
     ##
     # Returns the id of the entry or its url if not id is present, as some
     # formats don't support it
-    # rubocop:disable Naming/MemoizedInstanceVariableName
+    # rubocop:disable-next Naming/MemoizedInstanceVariableName
     def id
       @entry_id ||= @url
     end
-    # rubocop:enable Naming/MemoizedInstanceVariableName
 
     ##
     # Writer for published. By default, we keep the "oldest" publish time found.

data/lib/feedjira/feed_utilities.rb

@@ -58,7 +58,7 @@ module Feedjira
 
     def update_from_feed(feed)
       self.new_entries += find_new_entries_for(feed)
-      entries.unshift(*self.new_entries)
+      entries.unshift(*new_entries)
 
       @updated = false
 

data/lib/feedjira/rss_entry_utilities.rb

@@ -2,7 +2,7 @@
 
 module Feedjira
   module RSSEntryUtilities
-    # rubocop:todo Metrics/MethodLength
+    # rubocop:todo-next Metrics/MethodLength
     def self.included(mod) # rubocop:todo Metrics/AbcSize, Metrics/MethodLength
       mod.class_exec do
         element :title
@@ -40,7 +40,6 @@ module Feedjira
         elements :category, as: :categories
       end
     end
-    # rubocop:enable Metrics/MethodLength
 
     def entry_id
       @entry_id&.guid

data/lib/feedjira/sax_nokogiri_handler_patch.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "sax-machine/handlers/sax_nokogiri_handler"
+
+module Feedjira
+  # sax-machine's Nokogiri handler turns on entity replacement, which makes
+  # libxml2 load external entities declared in a feed's DOCTYPE (XXE). This
+  # parses with Nokogiri's default instead, which still decodes predefined
+  # entities, character references, and internal entities in text.
+  module SAXNokogiriHandlerPatch
+    # Parse without entity replacement so external entities are never loaded.
+    def sax_parse(xml_input)
+      ::Nokogiri::XML::SAX::Parser.new(self).parse(xml_input)
+    end
+
+    # Without entity replacement, libxml2 returns "&" in attribute values as
+    # "&", so we turn it back into "&".
+    def start_element(name, attrs = [])
+      super(name, attrs.map { |key, value| [key, value.gsub("&", "&")] })
+    end
+  end
+end
+
+::SAXMachine::SAXNokogiriHandler.prepend(::Feedjira::SAXNokogiriHandlerPatch)

data/lib/feedjira/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Feedjira
-  VERSION = "4.0.2"
+  VERSION = "4.0.3"
 end

data/lib/feedjira.rb

@@ -6,6 +6,7 @@ require "loofah"
 require "logger"
 require "json"
 
+require_relative "feedjira/sax_nokogiri_handler_patch"
 require_relative "feedjira/util"
 require_relative "feedjira/util/parse_time"
 require_relative "feedjira/configuration"

data/spec/feedjira/parser/atom_spec.rb

@@ -133,10 +133,10 @@ module Feedjira
         feed = Atom.parse sample_atom_xhtml_feed
         entry = feed.entries.first
 
-        expect(entry.raw_title).to match(/<i/)
+        expect(entry.raw_title).to include("<i")
         expect(entry.title).to eq("Sentry Calming Collar for dogs")
         expect(entry.title_type).to eq("xhtml")
-        expect(entry.summary).to match(/<b/)
+        expect(entry.summary).to include("<b")
         expect(entry.content).to match(/\A<p/)
       end
 

data/spec/feedjira/preprocessor_spec.rb

@@ -17,8 +17,8 @@ describe Feedjira::Preprocessor do
     escaped = processor.to_xml
     escaped_parts = escaped.split "\n"
 
-    expect(escaped_parts[10]).to match(%r{<i>dogs</i>}) # title
-    expect(escaped_parts[16]).to match(%r{<b>XHTML</b>}) # summary
+    expect(escaped_parts[10]).to include("<i>dogs</i>") # title
+    expect(escaped_parts[16]).to include("<b>XHTML</b>") # summary
     expect(escaped_parts[26]).to match(/<p>$/) # content
   end
 

data/spec/feedjira/sax_nokogiri_handler_patch_spec.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "tempfile"
+
+::RSpec.describe(::Feedjira::SAXNokogiriHandlerPatch) do
+  around do |example|
+    original_handler = ::SAXMachine.handler
+    ::SAXMachine.handler = :nokogiri
+    example.run
+  ensure
+    ::SAXMachine.handler = original_handler
+  end
+
+  def rss_with_entry(title: "Title", link: "https://example.com", doctype: "")
+    <<~XML
+      <?xml version="1.0"?>
+      #{doctype}
+      <rss version="2.0">
+        <channel>
+          <title>Feed</title>
+          <item>
+            <title>#{title}</title>
+            <enclosure url="#{link}" type="audio/mpeg"/>
+          </item>
+        </channel>
+      </rss>
+    XML
+  end
+
+  it "does not load external entities" do
+    secret = ::Tempfile.new
+    secret.write("secret contents")
+    secret.flush
+    doctype = %(<!DOCTYPE rss [<!ENTITY file SYSTEM "file://#{secret.path}">]>)
+
+    feed = ::Feedjira.parse(rss_with_entry(title: "&file;", doctype:))
+
+    expect(feed.entries.first.title.to_s).not_to(include("secret contents"))
+  ensure
+    secret.close!
+  end
+
+  it "decodes predefined entities and character references in text" do
+    feed = ::Feedjira.parse(rss_with_entry(title: "a &amp; b &lt; c &#8217;"))
+
+    expect(feed.entries.first.title).to(eq("a & b < c ’"))
+  end
+
+  it "expands internal entities in text" do
+    doctype = '<!DOCTYPE rss [<!ENTITY co "Acme Inc">]>'
+
+    feed = ::Feedjira.parse(rss_with_entry(title: "by &co;", doctype:))
+
+    expect(feed.entries.first.title).to(eq("by Acme Inc"))
+  end
+
+  it "decodes ampersands in attribute values" do
+    xml = rss_with_entry(link: "https://example.com/?a=1&amp;b=2&amp;c=&amp;#38;")
+
+    feed = ::Feedjira.parse(xml, parser: ::Feedjira::Parser::ITunesRSS)
+
+    expect(feed.entries.first.enclosure_url).to(eq("https://example.com/?a=1&b=2&c=&#38;"))
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: feedjira
 version: !ruby/object:Gem::Version
-  version: 4.0.2
+  version: 4.0.3
 platform: ruby
 authors:
 - Adam Hess
@@ -127,6 +127,7 @@ files:
 - lib/feedjira/parser/rss_image.rb
 - lib/feedjira/preprocessor.rb
 - lib/feedjira/rss_entry_utilities.rb
+- lib/feedjira/sax_nokogiri_handler_patch.rb
 - lib/feedjira/util.rb
 - lib/feedjira/util/parse_time.rb
 - lib/feedjira/version.rb
@@ -157,6 +158,7 @@ files:
 - spec/feedjira/parser/rss_feed_burner_spec.rb
 - spec/feedjira/parser/rss_spec.rb
 - spec/feedjira/preprocessor_spec.rb
+- spec/feedjira/sax_nokogiri_handler_patch_spec.rb
 - spec/feedjira/util/parse_time_spec.rb
 - spec/feedjira_spec.rb
 - spec/sample_feeds.rb
@@ -227,7 +229,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A feed parsing library
 test_files: []