mwmitchell-solr-ruby 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/LICENSE +201 -0
- data/README.rdoc +92 -0
- data/Rakefile +72 -0
- data/examples/direct.rb +14 -0
- data/examples/http.rb +7 -0
- data/lib/core_ext.rb +8 -0
- data/lib/solr/adapter/common_methods.rb +89 -0
- data/lib/solr/adapter/direct.rb +65 -0
- data/lib/solr/adapter/http.rb +55 -0
- data/lib/solr/adapter.rb +7 -0
- data/lib/solr/connection/base.rb +122 -0
- data/lib/solr/connection/search_ext.rb +110 -0
- data/lib/solr/connection.rb +7 -0
- data/lib/solr/indexer.rb +23 -0
- data/lib/solr.rb +36 -0
- data/solr-ruby.gemspec +50 -0
- data/test/adapter_common_methods_test.rb +49 -0
- data/test/connection_test_methods.rb +82 -0
- data/test/direct_test.rb +20 -0
- data/test/ext_pagination_test.rb +58 -0
- data/test/ext_search_test.rb +9 -0
- data/test/http_test.rb +13 -0
- data/test/indexer_test.rb +14 -0
- data/test/mapper_test.rb +105 -0
- data/test/message_test.rb +70 -0
- data/test/ruby-lang.org.rss.xml +391 -0
- data/test/test_helpers.rb +31 -0
- metadata +92 -0
data/test/mapper_test.rb
ADDED
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
require File.join(File.dirname(__FILE__), 'test_helpers')
|
|
2
|
+
|
|
3
|
+
require 'rss'
|
|
4
|
+
|
|
5
|
+
class MapperTest < Test::Unit::TestCase
|
|
6
|
+
|
|
7
|
+
# simple replacement
|
|
8
|
+
def test_string_map
|
|
9
|
+
data = {
|
|
10
|
+
:skip_this=>'!'
|
|
11
|
+
}
|
|
12
|
+
mapping = {
|
|
13
|
+
:id=>'one',
|
|
14
|
+
:name=>'foo'
|
|
15
|
+
}
|
|
16
|
+
mapper = Solr::Mapper::Base.new(mapping)
|
|
17
|
+
expected = [mapping]
|
|
18
|
+
assert_equal expected, mapper.map(data)
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
# test enumerable/array mappings
|
|
22
|
+
def test_array_multi_value
|
|
23
|
+
data = {
|
|
24
|
+
:NUMID=>100,
|
|
25
|
+
:type=>:type_val,
|
|
26
|
+
:code=>:code_val
|
|
27
|
+
}
|
|
28
|
+
mapping = {
|
|
29
|
+
:id=>:NUMID,
|
|
30
|
+
:name=>'foo',
|
|
31
|
+
:category=>[:type, :code]
|
|
32
|
+
}
|
|
33
|
+
mapper = Solr::Mapper::Base.new(mapping)
|
|
34
|
+
expected = [{:name=>"foo", :category=>[:type_val, :code_val], :id=>100}]
|
|
35
|
+
assert_equal expected, mapper.map(data)
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
# test the proc mapping type
|
|
39
|
+
# test that the second arg in the block is a Solr::Mapper
|
|
40
|
+
def test_proc
|
|
41
|
+
data = [{:name=>'-bach;'}]
|
|
42
|
+
mapping = {
|
|
43
|
+
:name=>proc{|d,mapper|
|
|
44
|
+
assert_equal Solr::Mapper::Base, mapper.class
|
|
45
|
+
d[:name].gsub(/\W+/, '')
|
|
46
|
+
}
|
|
47
|
+
}
|
|
48
|
+
mapper = Solr::Mapper::Base.new(mapping)
|
|
49
|
+
expected = [{:name=>"bach"}]
|
|
50
|
+
assert_equal expected, mapper.map(data)
|
|
51
|
+
end
|
|
52
|
+
|
|
53
|
+
def rss_file
|
|
54
|
+
@rss_file ||= File.join(File.dirname(__FILE__), 'ruby-lang.org.rss.xml')
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
# load an rss feed
|
|
58
|
+
# create a mapping
|
|
59
|
+
# map it and test the fields
|
|
60
|
+
def raw_mapping_rss_docs
|
|
61
|
+
rss = RSS::Parser.parse(File.read(rss_file), false)
|
|
62
|
+
mapping = {
|
|
63
|
+
:channel=>rss.channel.title,
|
|
64
|
+
:url=>rss.channel.link,
|
|
65
|
+
:total=>rss.items.size,
|
|
66
|
+
:title=>proc {|item,m| item.title },
|
|
67
|
+
:link=>proc{|item,m| item.link },
|
|
68
|
+
:published=>proc{|item,m| item.date },
|
|
69
|
+
:description=>proc{|item,m| item.description }
|
|
70
|
+
}
|
|
71
|
+
mapper = Solr::Mapper::Base.new(mapping)
|
|
72
|
+
mapper.map(rss.items)
|
|
73
|
+
end
|
|
74
|
+
|
|
75
|
+
# load an rss feed
|
|
76
|
+
# create a mapping
|
|
77
|
+
# map it and test the fields
|
|
78
|
+
def rss_mapper_docs
|
|
79
|
+
m = Solr::Mapper::RSS.new
|
|
80
|
+
mapping = {
|
|
81
|
+
:channel=>:'channel.title',
|
|
82
|
+
:url=>:'channel.link',
|
|
83
|
+
:total=>:'items.size',
|
|
84
|
+
:title=>proc {|item,m| item.title },
|
|
85
|
+
:link=>proc {|item,m| item.link },
|
|
86
|
+
:published=>proc {|item,m| item.date },
|
|
87
|
+
:description=>proc {|item,m| item.description }
|
|
88
|
+
}
|
|
89
|
+
m.map(rss_file, mapping)
|
|
90
|
+
end
|
|
91
|
+
|
|
92
|
+
def test_rss
|
|
93
|
+
[rss_mapper_docs, raw_mapping_rss_docs].each do |docs|
|
|
94
|
+
assert_equal 10, docs.size
|
|
95
|
+
first = docs.first
|
|
96
|
+
# make sure the mapped solr docs have all of the keys from the mapping
|
|
97
|
+
#assert mapping.keys.all?{|mapping_key| first.keys.include?(mapping_key) }
|
|
98
|
+
assert_equal docs.size, docs.first[:total].to_i
|
|
99
|
+
assert_equal Time.parse('Mon Nov 10 09:55:53 -0500 2008'), first[:published]
|
|
100
|
+
assert_equal 'http://www.ruby-lang.org/en/feeds/news.rss/', first[:url]
|
|
101
|
+
assert_equal 'Scotland on Rails 2009', first[:title]
|
|
102
|
+
end
|
|
103
|
+
end
|
|
104
|
+
|
|
105
|
+
end
|
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
require File.join(File.dirname(__FILE__), 'test_helpers')
|
|
2
|
+
|
|
3
|
+
class MessageTest < Test::Unit::TestCase
|
|
4
|
+
|
|
5
|
+
# call all of the simple methods...
|
|
6
|
+
# make sure the xml string is valid
|
|
7
|
+
# ensure the class is actually Solr::XML
|
|
8
|
+
def test_simple_methods
|
|
9
|
+
[:optimize, :rollback, :commit].each do |meth|
|
|
10
|
+
result = Solr::Message.send(meth)
|
|
11
|
+
assert_equal "<#{meth}/>", result.to_s
|
|
12
|
+
assert_equal String, result.class
|
|
13
|
+
end
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
def test_delete_by_id
|
|
17
|
+
result = Solr::Message.delete_by_id(10)
|
|
18
|
+
assert_equal String, result.class
|
|
19
|
+
assert_equal '<delete><id>10</id></delete>', result.to_s
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
def test_delete_by_multiple_ids
|
|
23
|
+
result = Solr::Message.delete_by_id([1, 2, 3])
|
|
24
|
+
assert_equal String, result.class
|
|
25
|
+
assert_equal '<delete><id>1</id><id>2</id><id>3</id></delete>', result.to_s
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
def test_delete_by_query
|
|
29
|
+
result = Solr::Message.delete_by_id('status:"LOST"')
|
|
30
|
+
assert_equal String, result.class
|
|
31
|
+
assert_equal '<delete><id>status:"LOST"</id></delete>', result.to_s
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
def test_delete_by_multiple_queries
|
|
35
|
+
result = Solr::Message.delete_by_id(['status:"LOST"', 'quantity:0'])
|
|
36
|
+
assert_equal String, result.class
|
|
37
|
+
assert_equal '<delete><id>status:"LOST"</id><id>quantity:0</id></delete>', result.to_s
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
# add a single hash ("doc")
|
|
41
|
+
def test_add_hash
|
|
42
|
+
data = {
|
|
43
|
+
:id=>1,
|
|
44
|
+
:name=>'matt'
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
expected = '<add><doc><field name="id">1</field><field name="name">matt</field></doc></add>'
|
|
48
|
+
assert_equal expected, Solr::Message.add(data).to_s
|
|
49
|
+
end
|
|
50
|
+
|
|
51
|
+
# add an array of hashes
|
|
52
|
+
def test_add_array
|
|
53
|
+
data = [
|
|
54
|
+
{
|
|
55
|
+
:id=>1,
|
|
56
|
+
:name=>'matt'
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
:id=>2,
|
|
60
|
+
:name=>'sam'
|
|
61
|
+
}
|
|
62
|
+
]
|
|
63
|
+
|
|
64
|
+
message = Solr::Message.add(data)
|
|
65
|
+
expected = '<add><doc><field name="id">1</field><field name="name">matt</field></doc><doc><field name="id">2</field><field name="name">sam</field></doc></add>'
|
|
66
|
+
|
|
67
|
+
assert_equal expected, message.to_s
|
|
68
|
+
end
|
|
69
|
+
|
|
70
|
+
end
|
|
@@ -0,0 +1,391 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
|
|
3
|
+
<channel>
|
|
4
|
+
<title>Ruby News</title>
|
|
5
|
+
<link>http://www.ruby-lang.org/en/feeds/news.rss/</link>
|
|
6
|
+
<language>en-us</language>
|
|
7
|
+
<ttl>40</ttl>
|
|
8
|
+
<description>The latest news from Ruby-Lang.org.</description>
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
<item>
|
|
12
|
+
<title>Scotland on Rails 2009</title>
|
|
13
|
+
<description><p><a href="http://scotlandonrails.com">Scotland on Rails</a> is pleased to announce that Conference2009 will be held March 26-28 in Edinburgh, Scotland.</p>
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
<p>We are now accepting submissions. The closing date for submissions is December 1st 2008, so there&#8217;s still time! Please mail your plaintext proposals for 45 minute sessions to <a href="mailto:submissions@scotlandonrails.com">submissions@scotlandonrails.com</a>.</p>
|
|
17
|
+
|
|
18
|
+
|
|
19
|
+
<p>Alternatively, if you are interested in sponsoring the conference, please mail <a href="mailto:sponsorship@scotlandonrails.com">sponsorship@scotlandonrails.com</a> for a prospectus.</p>
|
|
20
|
+
|
|
21
|
+
|
|
22
|
+
<p>Lastly, if you wish to be notified when we open for registration, you can sign up on the site.</p>
|
|
23
|
+
|
|
24
|
+
|
|
25
|
+
<p>Come and enjoy all that Edinburgh has to offer (whisky! castle! volcano! ruby! whisky!) in March. We hope to see you there.</p> </description>
|
|
26
|
+
<pubDate>Mon, 10 Nov 2008 14:55:53 GMT</pubDate>
|
|
27
|
+
<guid>http://www.ruby-lang.org/en/news/2008/11/10/scotland-on-rails-2009/</guid>
|
|
28
|
+
<link>http://www.ruby-lang.org/en/news/2008/11/10/scotland-on-rails-2009/</link>
|
|
29
|
+
</item>
|
|
30
|
+
|
|
31
|
+
<item>
|
|
32
|
+
<title>MountainWest RubyConf 2009 dates and CFP</title>
|
|
33
|
+
<description><p><a href="http://mtnwestrubyconf.org">MountainWest RubyConf 2009</a> will be held March 13-14, 2009, in Salt Lake City, Utah, <span class="caps">USA</span>.</p>
|
|
34
|
+
|
|
35
|
+
|
|
36
|
+
<p>Proposals to speak at this regional conference are now being accepted. Please send your proposal to proposals@mtnwestrubyconf.org.</p>
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
<p>The submission deadline is midnight (MST) on December 31st, 2008.</p>
|
|
40
|
+
|
|
41
|
+
|
|
42
|
+
<p>There are sponsorship opportunities available as well. Please contact sponsorship@mtnwestruby.org if you are interested.</p>
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
<p>Please see <a href="http://mtnwestrubyconf.org">mtnwestrubyconf.org/</a> for more details as they become available.</p> </description>
|
|
46
|
+
<pubDate>Sat, 08 Nov 2008 15:03:32 GMT</pubDate>
|
|
47
|
+
<guid>http://www.ruby-lang.org/en/news/2008/11/08/mountainwest-rubyconf-2009-dates-and-cfp/</guid>
|
|
48
|
+
<link>http://www.ruby-lang.org/en/news/2008/11/08/mountainwest-rubyconf-2009-dates-and-cfp/</link>
|
|
49
|
+
</item>
|
|
50
|
+
|
|
51
|
+
<item>
|
|
52
|
+
<title> Ruby 1.9.1-preview 1 released</title>
|
|
53
|
+
<description><p>Yugui (Yuki Sonoda) announced the release of Ruby 1.9.1-preview 1:</p>
|
|
54
|
+
|
|
55
|
+
|
|
56
|
+
<blockquote>
|
|
57
|
+
This is a preview release of Ruby 1.9.1, which will be the first stable version of the Ruby 1.9 series. Try it out now and get an early taste of a modern, faster, multilingualized, and much improved Ruby with clearer syntax.<br><br>
|
|
58
|
+
|
|
59
|
+
<p>If you encounter any bugs or problems, please let us know via the official issue tracking system:</p>
|
|
60
|
+
|
|
61
|
+
|
|
62
|
+
<p><a href="http://redmine.ruby-lang.org">http://redmine.ruby-lang.org</a></p>
|
|
63
|
+
|
|
64
|
+
|
|
65
|
+
</blockquote>
|
|
66
|
+
|
|
67
|
+
<p>You can download the release from;</p>
|
|
68
|
+
|
|
69
|
+
|
|
70
|
+
<ul>
|
|
71
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-preview1.tar.bz2">ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-preview1.tar.bz2</a>
|
|
72
|
+
|
|
73
|
+
<p><span class="caps">SIZE</span>: 6169022 bytes
|
|
74
|
+
<span class="caps">MD5</span>: 0d51dc949bb6b438ad4ebfabbb5f6754
|
|
75
|
+
<span class="caps">SHA256</span>: dc39000537d7c7528ef26af8e1c3a6215b30b6c579c615eaec7013513410456a</p></li>
|
|
76
|
+
</ul>
|
|
77
|
+
|
|
78
|
+
|
|
79
|
+
<ul>
|
|
80
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-preview1.tar.gz">ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-preview1.tar.gz</a>
|
|
81
|
+
|
|
82
|
+
<p><span class="caps">SIZE</span>: 7409682 bytes
|
|
83
|
+
<span class="caps">MD5</span>: 738f701532452fd5d36f5c155f3ba692
|
|
84
|
+
<span class="caps">SHA256</span>: 99443bdae9f94ba7b08de187881f8cbee172379edf9c5fa85fc04c869150ff6d</p></li>
|
|
85
|
+
</ul>
|
|
86
|
+
|
|
87
|
+
|
|
88
|
+
<ul>
|
|
89
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-preview1.zip">ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-preview1.zip</a>
|
|
90
|
+
|
|
91
|
+
<p><span class="caps">SIZE</span>: 8569116 bytes
|
|
92
|
+
<span class="caps">MD5</span>: 5f68246246c4cd29d8a3b6b34b29b6ac
|
|
93
|
+
<span class="caps">SHA256</span>: a6c3a7bf7ea83b595024764926353e08596a78e40c57ac58c568662e5e88df95</p></li>
|
|
94
|
+
</ul> </description>
|
|
95
|
+
<pubDate>Tue, 28 Oct 2008 19:45:27 GMT</pubDate>
|
|
96
|
+
<guid>http://www.ruby-lang.org/en/news/2008/10/28/ruby-1-9-1-preview-1-released/</guid>
|
|
97
|
+
<link>http://www.ruby-lang.org/en/news/2008/10/28/ruby-1-9-1-preview-1-released/</link>
|
|
98
|
+
</item>
|
|
99
|
+
|
|
100
|
+
<item>
|
|
101
|
+
<title>RubyConf 2008 is Sold-out</title>
|
|
102
|
+
<description><p><a href="http://rubyconf.org/">RubyConf 2008</a> is sold out</p>
|
|
103
|
+
|
|
104
|
+
|
|
105
|
+
<p>However, there is a <a href="http://www.regonline.com/builder/site/Default.aspx?eventid=636797">waiting list</a> you can join in case of cancellations.</p> </description>
|
|
106
|
+
<pubDate>Thu, 02 Oct 2008 23:21:06 GMT</pubDate>
|
|
107
|
+
<guid>http://www.ruby-lang.org/en/news/2008/10/02/rubyconf-2008-is-sold-out/</guid>
|
|
108
|
+
<link>http://www.ruby-lang.org/en/news/2008/10/02/rubyconf-2008-is-sold-out/</link>
|
|
109
|
+
</item>
|
|
110
|
+
|
|
111
|
+
<item>
|
|
112
|
+
<title>Voices That Matter 2008</title>
|
|
113
|
+
<description><p>Pearson Education is running a <a href="http://www.voicesthatmatter.com/ruby2008/">Voices That Matter</a> Ruby conference this fall in Boston. The conference, from the same people who Addison-Wesley's Professional Ruby Series, will give you a chance to meet and learn from those very same authors. Don't miss a chance to interact with so many Ruby professionals.</p> </description>
|
|
114
|
+
<pubDate>Tue, 09 Sep 2008 02:49:37 GMT</pubDate>
|
|
115
|
+
<guid>http://www.ruby-lang.org/en/news/2008/09/09/voices-that-matter-2008/</guid>
|
|
116
|
+
<link>http://www.ruby-lang.org/en/news/2008/09/09/voices-that-matter-2008/</link>
|
|
117
|
+
</item>
|
|
118
|
+
|
|
119
|
+
<item>
|
|
120
|
+
<title>DoS vulnerability in REXML</title>
|
|
121
|
+
<description><p>There is a DoS vulnerability in the REXML library included in the Ruby
|
|
122
|
+
Standard Library. A so-called "XML entity explosion" attack technique
|
|
123
|
+
can be used for remotely bringing down (disabling) any application
|
|
124
|
+
which parses user-provided XML using REXML.</p><p>Most Rails applications will be vulnerable because Rails parses
|
|
125
|
+
user-provided XML using REXML by default. </p> <h2><a name="label-0" id="label-0">Impact</a></h2><!-- RDLabel: "Impact" --><p>An attacker can cause a denial of service by causing REXML to parse a
|
|
126
|
+
document containing recursively nested entities such as:</p><pre>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
|
|
127
|
+
&lt;!DOCTYPE member [
|
|
128
|
+
&lt;!ENTITY a "&amp;b;&amp;b;&amp;b;&amp;b;&amp;b;&amp;b;&amp;b;&amp;b;&amp;b;&amp;b;"&gt;
|
|
129
|
+
&lt;!ENTITY b "&amp;c;&amp;c;&amp;c;&amp;c;&amp;c;&amp;c;&amp;c;&amp;c;&amp;c;&amp;c;"&gt;
|
|
130
|
+
&lt;!ENTITY c "&amp;d;&amp;d;&amp;d;&amp;d;&amp;d;&amp;d;&amp;d;&amp;d;&amp;d;&amp;d;"&gt;
|
|
131
|
+
&lt;!ENTITY d "&amp;e;&amp;e;&amp;e;&amp;e;&amp;e;&amp;e;&amp;e;&amp;e;&amp;e;&amp;e;"&gt;
|
|
132
|
+
&lt;!ENTITY e "&amp;f;&amp;f;&amp;f;&amp;f;&amp;f;&amp;f;&amp;f;&amp;f;&amp;f;&amp;f;"&gt;
|
|
133
|
+
&lt;!ENTITY f "&amp;g;&amp;g;&amp;g;&amp;g;&amp;g;&amp;g;&amp;g;&amp;g;&amp;g;&amp;g;"&gt;
|
|
134
|
+
&lt;!ENTITY g "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"&gt;
|
|
135
|
+
]&gt;
|
|
136
|
+
&lt;member&gt;
|
|
137
|
+
&amp;a;
|
|
138
|
+
&lt;/member&gt;</pre><h2><a name="label-1" id="label-1">Vulnerable versions</a></h2><!-- RDLabel: "Vulnerable versions" --><h3><a name="label-2" id="label-2">1.8 series</a></h3><!-- RDLabel: "1.8 series" --><ul>
|
|
139
|
+
<li>1.8.6-p287 and all prior versions</li>
|
|
140
|
+
<li>1.8.7-p72 and all prior versions</li>
|
|
141
|
+
</ul><h3><a name="label-3" id="label-3">1.9 series</a></h3><!-- RDLabel: "1.9 series" --><ul>
|
|
142
|
+
<li>all versions</li>
|
|
143
|
+
</ul><h2><a name="label-4" id="label-4">Solution</a></h2><!-- RDLabel: "Solution" --><p>Please download the following monkey patch to fix this problem.</p><ul>
|
|
144
|
+
<li><a href="http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix2.rb">&lt;URL:http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix2.rb&gt;</a></li>
|
|
145
|
+
</ul><p>Then fix your application to load rexml-expansion-fix2.rb before using
|
|
146
|
+
REXML.</p><pre>require "rexml-expansion-fix2"
|
|
147
|
+
...
|
|
148
|
+
doc = REXML::Document.new(str)
|
|
149
|
+
...</pre><p>If you have a Rails application, copy rexml-expansion-fix2.rb into a
|
|
150
|
+
directory on the load path (such as RAILS_ROOT/lib/), and put the
|
|
151
|
+
following line into config/environment.rb.</p><pre>require "rexml-expansion-fix2"</pre><p>If your application is Rails 2.1 or later, you can simply copy
|
|
152
|
+
rexml-expansion-fix2.rb to RAILS_ROOT/config/initializers and it will
|
|
153
|
+
be required automatically.</p><p>By default, XML entity expansion limit is 10000. You can change it by
|
|
154
|
+
changing REXML::Document.entity_expansion_limit. e.g.</p><pre>REXML::Document.entity_expansion_limit = 1000</pre><p>This fix will be made available as a gem and used by future versions of
|
|
155
|
+
rails, but users should take corrective action immediately.</p><h2><a name="label-5" id="label-5">Credit</a></h2><!-- RDLabel: "Credit" --><p>Credit to Luka Treiber and Mitja Kolsek of ACROS Security for
|
|
156
|
+
disclosing the problem to Ruby and Rails Security Teams.</p><p>Credit to Michael Koziarski of Rails Core Team for creating the monkey
|
|
157
|
+
patch to fix the vulnerability.</p><h2><a name="label-6" id="label-6">Changes</a></h2><!-- RDLabel: "Changes" --><ul>
|
|
158
|
+
<li>2008-08-29 18:46 +09:00 fixed the summary not to mislead that this vulnerability is Rails specific.</li>
|
|
159
|
+
<li>2008-11-09 12:40 +09:00 fixed <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502535">a bug of the monkey patch</a>.</li>
|
|
160
|
+
</ul></description>
|
|
161
|
+
<pubDate>Sat, 23 Aug 2008 07:56:11 GMT</pubDate>
|
|
162
|
+
<guid>http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/</guid>
|
|
163
|
+
<link>http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/</link>
|
|
164
|
+
</item>
|
|
165
|
+
|
|
166
|
+
<item>
|
|
167
|
+
<title>Ruby 1.8.7-p72 and 1.8.6-p287 released</title>
|
|
168
|
+
<description><p>Ruby 1.8.7-p72 and 1.8.6-p287 have been released.
|
|
169
|
+
The last releases were incomplete, and the new releases include fixes of <a href="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/#label-3">the previously announced vulnerability of dl</a>.</p><p>The released source archives are available at:</p><ul>
|
|
170
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz&gt;</a></li>
|
|
171
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.bz2">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.bz2&gt;</a></li>
|
|
172
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.zip">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.zip&gt;</a></li>
|
|
173
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.tar.gz&gt;</a></li>
|
|
174
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.tar.bz2">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.tar.bz2&gt;</a></li>
|
|
175
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.zip">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.zip&gt;</a></li>
|
|
176
|
+
</ul> <p>Checksums:</p><pre>MD5(ruby-1.8.6-p287.tar.gz)= f6cd51001534ced5375339707a757556
|
|
177
|
+
SHA256(ruby-1.8.6-p287.tar.gz)= 6463d1932c34ff72b79174ac7d2c28940d29d147928250928a00a0dbee43db57
|
|
178
|
+
SIZE(ruby-1.8.6-p287.tar.gz)= 4590393
|
|
179
|
+
|
|
180
|
+
MD5(ruby-1.8.6-p287.tar.bz2)= 80b5f3db12531d36e6c81fac6d05dda9
|
|
181
|
+
SHA256(ruby-1.8.6-p287.tar.bz2)= ac15a1cb78c50ec9cc7e831616a143586bdd566bc865c6b769a0c47b3b3936ce
|
|
182
|
+
SIZE(ruby-1.8.6-p287.tar.bz2)= 3956902
|
|
183
|
+
|
|
184
|
+
MD5(ruby-1.8.6-p287.zip)= e555d51f5b387fdd52ae53d9bafa13f5
|
|
185
|
+
SHA256(ruby-1.8.6-p287.zip)= 844c66c015565839531a34b83e0526cd4fa2a71cc0f5cc8ddb0d4c158403543a
|
|
186
|
+
SIZE(ruby-1.8.6-p287.zip)= 5606238
|
|
187
|
+
|
|
188
|
+
MD5(ruby-1.8.7-p72.tar.gz)= 5e5b7189674b3a7f69401284f6a7a36d
|
|
189
|
+
SHA256(ruby-1.8.7-p72.tar.gz)= e15ca005076f5d6f91fc856fdfbd071698a4cadac3c6e25855899dba1f6fc5ef
|
|
190
|
+
SIZE(ruby-1.8.7-p72.tar.gz)= 4805594
|
|
191
|
+
|
|
192
|
+
MD5(ruby-1.8.7-p72.tar.bz2)= 0b215c46b89b28d7ab8d56d96e72d5b9
|
|
193
|
+
SHA256(ruby-1.8.7-p72.tar.bz2)= a8f8a28e286dd76747d8e97ea5cfe7a315eb896906ab8c8606d687d9f6f6146e
|
|
194
|
+
SIZE(ruby-1.8.7-p72.tar.bz2)= 4127450
|
|
195
|
+
|
|
196
|
+
MD5(ruby-1.8.7-p72.zip)= b44fe5a12d4bf138ba0d3660e13a8216
|
|
197
|
+
SHA256(ruby-1.8.7-p72.zip)= 77e67be4aa8c3e041e1d20d24e5fcf2e33ad9bccb3da3332b6c0a5b648334903
|
|
198
|
+
SIZE(ruby-1.8.7-p72.zip)= 5855902</pre><p>For a full list of all changes, see the bundled files named ChangeLog, which are also available at the following locations:</p><ul>
|
|
199
|
+
<li><a href="http://svn.ruby-lang.org/repos/ruby/tags/v1_8_6_287/ChangeLog">&lt;URL:http://svn.ruby-lang.org/repos/ruby/tags/v1_8_6_287/ChangeLog&gt;</a></li>
|
|
200
|
+
<li><a href="http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_72/ChangeLog">&lt;URL:http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_72/ChangeLog&gt;</a></li>
|
|
201
|
+
</ul></description>
|
|
202
|
+
<pubDate>Mon, 11 Aug 2008 02:01:00 GMT</pubDate>
|
|
203
|
+
<guid>http://www.ruby-lang.org/en/news/2008/08/11/ruby-1-8-7-p72-and-1-8-6-p287-released/</guid>
|
|
204
|
+
<link>http://www.ruby-lang.org/en/news/2008/08/11/ruby-1-8-7-p72-and-1-8-6-p287-released/</link>
|
|
205
|
+
</item>
|
|
206
|
+
|
|
207
|
+
<item>
|
|
208
|
+
<title>Multiple vulnerabilities in Ruby</title>
|
|
209
|
+
<description><p>Multiple vulnerabilities have been discovered in Ruby. It's
|
|
210
|
+
recommended that you upgrade to the latest versions.</p> <h2><a name="label-0" id="label-0">Details</a></h2><!-- RDLabel: "Details" --><p>The following vulnerabilities have been discovered.</p><h3><a name="label-1" id="label-1">Several vulnerabilities in safe level</a></h3><!-- RDLabel: "Several vulnerabilities in safe level" --><p>Several vulnerabilities in safe level have been discovered.</p><ul>
|
|
211
|
+
<li><p>untrace_var is permitted at safe level 4.</p>
|
|
212
|
+
<pre>trace_var(:$VAR) {|val| puts "$VAR = #{val}" }
|
|
213
|
+
|
|
214
|
+
Thread.new do
|
|
215
|
+
$SAFE = 4
|
|
216
|
+
eval %q{
|
|
217
|
+
proc = untrace_var :$VAR
|
|
218
|
+
proc.first.call("aaa")
|
|
219
|
+
}
|
|
220
|
+
end.join</pre></li>
|
|
221
|
+
<li><p>$PROGRAM_NAME may be modified at safe level 4.</p>
|
|
222
|
+
<pre>Thread.new do
|
|
223
|
+
$SAFE = 4
|
|
224
|
+
eval %q{$PROGRAM_NAME.replace "Hello, World!"}
|
|
225
|
+
end.join
|
|
226
|
+
|
|
227
|
+
$PROGRAM_NAME #=&gt; "Hello, World!"</pre></li>
|
|
228
|
+
<li><p>Insecure methods may be called at safe level 1-3.</p>
|
|
229
|
+
<pre>class Hello
|
|
230
|
+
def world
|
|
231
|
+
Thread.new do
|
|
232
|
+
$SAFE = 4
|
|
233
|
+
msg = "Hello, World!"
|
|
234
|
+
def msg.size
|
|
235
|
+
self.replace self*10 # replace string
|
|
236
|
+
1 # return wrong size
|
|
237
|
+
end
|
|
238
|
+
msg
|
|
239
|
+
end.value
|
|
240
|
+
end
|
|
241
|
+
end
|
|
242
|
+
|
|
243
|
+
$SAFE = 1 # or 2, or 3
|
|
244
|
+
s = Hello.new.world
|
|
245
|
+
if s.kind_of?(String)
|
|
246
|
+
puts s if s.size &lt; 20 # print string which size is less than 20
|
|
247
|
+
end</pre></li>
|
|
248
|
+
<li><p>Syslog operations are permitted at safe level 4.</p>
|
|
249
|
+
<pre>require "syslog"
|
|
250
|
+
|
|
251
|
+
Syslog.open
|
|
252
|
+
|
|
253
|
+
Thread.new do
|
|
254
|
+
$SAFE = 4
|
|
255
|
+
eval %q{
|
|
256
|
+
Syslog.log(Syslog::LOG_WARNING, "Hello, World!")
|
|
257
|
+
Syslog.mask = Syslog::LOG_UPTO(Syslog::LOG_EMERG)
|
|
258
|
+
Syslog.info("masked")
|
|
259
|
+
Syslog.close
|
|
260
|
+
}
|
|
261
|
+
end.join</pre></li>
|
|
262
|
+
</ul><p>These vulnerabilities were reported by Keita Yamaguchi.</p><h3><a name="label-2" id="label-2">DoS vulnerability in WEBrick</a></h3><!-- RDLabel: "DoS vulnerability in WEBrick" --><p>WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking
|
|
263
|
+
requests due to a backtracking regular expression in
|
|
264
|
+
WEBrick::HTTPUtils.split_header_value.</p><p>Exploitable server:</p><pre>require 'webrick'
|
|
265
|
+
WEBrick::HTTPServer.new(:Port =&gt; 2000, :DocumentRoot =&gt; "/etc").start</pre><p>Attack:</p><pre>require 'net/http'
|
|
266
|
+
res = Net::HTTP.start("localhost", 2000) { |http|
|
|
267
|
+
req = Net::HTTP::Get.new("/passwd")
|
|
268
|
+
req['If-None-Match'] = %q{meh=""} + %q{foo="bar" } * 100
|
|
269
|
+
http.request(req)
|
|
270
|
+
}
|
|
271
|
+
p res</pre><p>The request likely won't finish in this universe.</p><p>This vulnerability was reported by Christian Neukirchen.</p><h3><a name="label-3" id="label-3">Lack of taintness check in dl</a></h3><!-- RDLabel: "Lack of taintness check in dl" --><p>dl doesn't check taintness, so it could allow attackers to call
|
|
272
|
+
dangerous functions.</p><pre>require 'dl'
|
|
273
|
+
$SAFE = 1
|
|
274
|
+
h = DL.dlopen(nil)
|
|
275
|
+
sys = h.sym('system', 'IP')
|
|
276
|
+
uname = 'uname -rs'.taint
|
|
277
|
+
sys[uname]</pre><p>This vulnerability was reported by sheepman.</p><h3><a name="label-4" id="label-4">DNS spoofing vulnerability in resolv.rb</a></h3><!-- RDLabel: "DNS spoofing vulnerability in resolv.rb" --><p>resolv.rb allow remote attackers to spoof DNS answers. This risk can be
|
|
278
|
+
reduced by randomness of DNS transaction IDs and source ports, so resolv.rb
|
|
279
|
+
is fixed to randomize them.</p><ul>
|
|
280
|
+
<li>see also: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447">CVE-2008-1447</a></li>
|
|
281
|
+
</ul><p>This vulnerability was reported by Tanaka Akira.</p><h2><a name="label-5" id="label-5">Vulnerable versions</a></h2><!-- RDLabel: "Vulnerable versions" --><dl>
|
|
282
|
+
<dt><a name="label-6" id="label-6">1.8 series</a></dt><!-- RDLabel: "1.8 series" -->
|
|
283
|
+
<dd>
|
|
284
|
+
<ul>
|
|
285
|
+
<li>1.8.5 and all prior versions</li>
|
|
286
|
+
<li>1.8.6-p286 and all prior versions</li>
|
|
287
|
+
<li>1.8.7-p71 and all prior versions</li>
|
|
288
|
+
</ul>
|
|
289
|
+
</dd>
|
|
290
|
+
<dt><a name="label-7" id="label-7">1.9 series</a></dt><!-- RDLabel: "1.9 series" -->
|
|
291
|
+
<dd>
|
|
292
|
+
<ul>
|
|
293
|
+
<li>r18423 and all prior revisions</li>
|
|
294
|
+
</ul>
|
|
295
|
+
</dd>
|
|
296
|
+
</dl><h2><a name="label-8" id="label-8">Solution</a></h2><!-- RDLabel: "Solution" --><dl>
|
|
297
|
+
<dt><a name="label-9" id="label-9">1.8 series</a></dt><!-- RDLabel: "1.8 series" -->
|
|
298
|
+
<dd>
|
|
299
|
+
Please upgrade to 1.8.6-p287, or 1.8.7-p72.
|
|
300
|
+
<ul>
|
|
301
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz&gt;</a></li>
|
|
302
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p72.tar.gz&gt;</a></li>
|
|
303
|
+
</ul>
|
|
304
|
+
</dd>
|
|
305
|
+
<dt><a name="label-10" id="label-10">1.9 series</a></dt><!-- RDLabel: "1.9 series" -->
|
|
306
|
+
<dd>
|
|
307
|
+
<p>Please check out the latest version using Subversion.</p>
|
|
308
|
+
<pre>$ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby</pre>
|
|
309
|
+
</dd>
|
|
310
|
+
</dl><p>Please note that a package that corrects this weakness may already be
|
|
311
|
+
available through your package management software.</p><h2><a name="label-11" id="label-11">Credit</a></h2><!-- RDLabel: "Credit" --><p>Credit to Keita Yamaguchi, Christian Neukirchen, sheepman, and Tanaka
|
|
312
|
+
Akira for disclosing these problems to Ruby Security Team.</p><h2><a name="label-12" id="label-12">Changes</a></h2><!-- RDLabel: "Changes" --><ul>
|
|
313
|
+
<li>2008-08-08 12:21 +09:00 fixed the revision number of ruby 1.9.</li>
|
|
314
|
+
<li>2008-08-11 11:23 +09:00 fixed the patchlevel of ruby 1.8. see <a href="http://www.ruby-lang.org/en/news/2008/08/11/ruby-1-8-7-p72-and-1-8-6-p287-released/">the release announcement of Ruby 1.8.7-p72 and 1.8.6-p287</a></li>
|
|
315
|
+
</ul></description>
|
|
316
|
+
<pubDate>Fri, 08 Aug 2008 02:59:49 GMT</pubDate>
|
|
317
|
+
<guid>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</guid>
|
|
318
|
+
<link>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</link>
|
|
319
|
+
</item>
|
|
320
|
+
|
|
321
|
+
<item>
|
|
322
|
+
<title>RubyConf 2008 Proposals Now Being Accepted</title>
|
|
323
|
+
<description><p><a href="http://www.rubyconf.org">RubyConf 2008</a> will be held in Orlando, Florida, <span class="caps">USA</span>, from November 6 to November 8.</p>
|
|
324
|
+
|
|
325
|
+
|
|
326
|
+
<p><a href="http://www.rubyconf.org/proposals/new">Proposals for presentations</a> are now begin accepted. All proposals must be received by August 21.</p> </description>
|
|
327
|
+
<pubDate>Mon, 04 Aug 2008 20:26:29 GMT</pubDate>
|
|
328
|
+
<guid>http://www.ruby-lang.org/en/news/2008/08/04/rubyconf-2008-proposals-now-being-accepted/</guid>
|
|
329
|
+
<link>http://www.ruby-lang.org/en/news/2008/08/04/rubyconf-2008-proposals-now-being-accepted/</link>
|
|
330
|
+
</item>
|
|
331
|
+
|
|
332
|
+
<item>
|
|
333
|
+
<title>Arbitrary code execution vulnerabilities</title>
|
|
334
|
+
<description><p>Multiple vulnerabilities in Ruby may lead to a denial of service (DoS)
|
|
335
|
+
condition or allow execution of arbitrary code.</p> <h2><a name="label-0" id="label-0">Impact</a></h2><!-- RDLabel: "Impact" --><p>With the following vulnerabilities, an attacker can lead to denial of
|
|
336
|
+
service condition or execute arbitrary code.</p><ul>
|
|
337
|
+
<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2662">CVE-2008-2662</a></li>
|
|
338
|
+
<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2663">CVE-2008-2663</a></li>
|
|
339
|
+
<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2725">CVE-2008-2725</a></li>
|
|
340
|
+
<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2726">CVE-2008-2726</a></li>
|
|
341
|
+
<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2664">CVE-2008-2664</a></li>
|
|
342
|
+
</ul><h2><a name="label-1" id="label-1">Vulnerable versions</a></h2><!-- RDLabel: "Vulnerable versions" --><dl>
|
|
343
|
+
<dt><a name="label-2" id="label-2">1.8 series</a></dt><!-- RDLabel: "1.8 series" -->
|
|
344
|
+
<dd>
|
|
345
|
+
<ul>
|
|
346
|
+
<li>1.8.4 and all prior versions</li>
|
|
347
|
+
<li>1.8.5-p230 and all prior versions</li>
|
|
348
|
+
<li>1.8.6-p229 and all prior versions</li>
|
|
349
|
+
<li>1.8.7-p21 and all prior versions</li>
|
|
350
|
+
</ul>
|
|
351
|
+
</dd>
|
|
352
|
+
<dt><a name="label-3" id="label-3">1.9 series</a></dt><!-- RDLabel: "1.9 series" -->
|
|
353
|
+
<dd>
|
|
354
|
+
<ul>
|
|
355
|
+
<li>1.9.0-1 and all prior versions</li>
|
|
356
|
+
</ul>
|
|
357
|
+
</dd>
|
|
358
|
+
</dl><h2><a name="label-4" id="label-4">Solution</a></h2><!-- RDLabel: "Solution" --><dl>
|
|
359
|
+
<dt><a name="label-5" id="label-5">1.8 series</a></dt><!-- RDLabel: "1.8 series" -->
|
|
360
|
+
<dd>
|
|
361
|
+
Please upgrade to 1.8.5-p231, or 1.8.6-p230, or 1.8.7-p22.
|
|
362
|
+
<ul>
|
|
363
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p231.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p231.tar.gz&gt;</a>
|
|
364
|
+
(md5sum: e900cf225d55414bffe878f00a85807c)</li>
|
|
365
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p230.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p230.tar.gz&gt;</a>
|
|
366
|
+
(md5sum: 5e8247e39be2dc3c1a755579c340857f)</li>
|
|
367
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz&gt;</a>
|
|
368
|
+
(md5sum: fc3ede83a98f48d8cb6de2145f680ef2)</li>
|
|
369
|
+
</ul>
|
|
370
|
+
</dd>
|
|
371
|
+
<dt><a name="label-6" id="label-6">1.9 series</a></dt><!-- RDLabel: "1.9 series" -->
|
|
372
|
+
<dd>
|
|
373
|
+
Please upgrade to 1.9.0-2.
|
|
374
|
+
<ul>
|
|
375
|
+
<li><a href="ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-2.tar.gz">&lt;URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-2.tar.gz&gt;</a>
|
|
376
|
+
(md5sum: 2a848b81ed1d6393b88eec8aa6173b75)</li>
|
|
377
|
+
</ul>
|
|
378
|
+
</dd>
|
|
379
|
+
</dl><p>These versions also fix the vulnerability of WEBrick (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1891">CVE-2008-1891</a>).</p><p>Please note that a package that corrects this weakness may already be
|
|
380
|
+
available through your package management software.</p><h2><a name="label-7" id="label-7">Credit</a></h2><!-- RDLabel: "Credit" --><p>Credit to Drew Yao of Apple Product Security for disclosing the problem to Ruby
|
|
381
|
+
Security Team.</p><h2><a name="label-8" id="label-8">Changes</a></h2><!-- RDLabel: "Changes" --><ul>
|
|
382
|
+
<li>2008-06-21 00:29 +09:00 removed wrong CVE IDs (CVE-2008-2727, CVE-2008-2728).</li>
|
|
383
|
+
</ul></description>
|
|
384
|
+
<pubDate>Fri, 20 Jun 2008 12:54:43 GMT</pubDate>
|
|
385
|
+
<guid>http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/</guid>
|
|
386
|
+
<link>http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/</link>
|
|
387
|
+
</item>
|
|
388
|
+
|
|
389
|
+
|
|
390
|
+
</channel>
|
|
391
|
+
</rss>
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
$: << File.dirname(__FILE__)
|
|
2
|
+
require File.join(File.dirname(__FILE__), '..', 'lib', 'solr')
|
|
3
|
+
require 'test/unit'
|
|
4
|
+
|
|
5
|
+
#begin
|
|
6
|
+
# require 'rubygems'
|
|
7
|
+
# require 'redgreen'
|
|
8
|
+
#rescue LoadError
|
|
9
|
+
#end
|
|
10
|
+
|
|
11
|
+
def mock_query_response
|
|
12
|
+
{'responseHeader'=>{
|
|
13
|
+
'status'=>0,'QTime'=>43,'params'=>{
|
|
14
|
+
'q'=>'*:*','wt'=>'ruby','echoParams'=>'EXPLICIT'
|
|
15
|
+
}
|
|
16
|
+
},
|
|
17
|
+
'response'=>{
|
|
18
|
+
'numFound'=>26,'start'=>0,'docs'=>[
|
|
19
|
+
{'id'=>'SP2514N','inStock'=>true,'manu'=>'Samsung Electronics Co. Ltd.','name'=>'Samsung SpinPoint P120 SP2514N - hard drive - 250 GB - ATA-133','popularity'=>6,'price'=>92.0,'sku'=>'SP2514N','timestamp'=>'2008-11-21T17:21:55.601Z','cat'=>['electronics','hard drive'],'spell'=>['Samsung SpinPoint P120 SP2514N - hard drive - 250 GB - ATA-133'],'features'=>['7200RPM, 8MB cache, IDE Ultra ATA-133','NoiseGuard, SilentSeek technology, Fluid Dynamic Bearing (FDB) motor']},
|
|
20
|
+
{'id'=>'6H500F0','inStock'=>true,'manu'=>'Maxtor Corp.','name'=>'Maxtor DiamondMax 11 - hard drive - 500 GB - SATA-300','popularity'=>6,'price'=>350.0,'sku'=>'6H500F0','timestamp'=>'2008-11-21T17:21:55.617Z','cat'=>['electronics','hard drive'],'spell'=>['Maxtor DiamondMax 11 - hard drive - 500 GB - SATA-300'],'features'=>['SATA 3.0Gb/s, NCQ','8.5ms seek','16MB cache']},
|
|
21
|
+
{'id'=>'F8V7067-APL-KIT','inStock'=>false,'manu'=>'Belkin','name'=>'Belkin Mobile Power Cord for iPod w/ Dock','popularity'=>1,'price'=>19.95,'sku'=>'F8V7067-APL-KIT','timestamp'=>'2008-11-21T17:21:55.652Z','weight'=>4.0,'cat'=>['electronics','connector'],'spell'=>['Belkin Mobile Power Cord for iPod w/ Dock'],'features'=>['car power adapter, white']},
|
|
22
|
+
{'id'=>'IW-02','inStock'=>false,'manu'=>'Belkin','name'=>'iPod & iPod Mini USB 2.0 Cable','popularity'=>1,'price'=>11.5,'sku'=>'IW-02','timestamp'=>'2008-11-21T17:21:55.657Z','weight'=>2.0,'cat'=>['electronics','connector'],'spell'=>['iPod & iPod Mini USB 2.0 Cable'],'features'=>['car power adapter for iPod, white']},
|
|
23
|
+
{'id'=>'MA147LL/A','inStock'=>true,'includes'=>'earbud headphones, USB cable','manu'=>'Apple Computer Inc.','name'=>'Apple 60 GB iPod with Video Playback Black','popularity'=>10,'price'=>399.0,'sku'=>'MA147LL/A','timestamp'=>'2008-11-21T17:21:55.681Z','weight'=>5.5,'cat'=>['electronics','music'],'spell'=>['Apple 60 GB iPod with Video Playback Black'],'features'=>['iTunes, Podcasts, Audiobooks','Stores up to 15,000 songs, 25,000 photos, or 150 hours of video','2.5-inch, 320x240 color TFT LCD display with LED backlight','Up to 20 hours of battery life','Plays AAC, MP3, WAV, AIFF, Audible, Apple Lossless, H.264 video','Notes, Calendar, Phone book, Hold button, Date display, Photo wallet, Built-in games, JPEG photo playback, Upgradeable firmware, USB 2.0 compatibility, Playback speed control, Rechargeable capability, Battery level indication']},
|
|
24
|
+
{'id'=>'TWINX2048-3200PRO','inStock'=>true,'manu'=>'Corsair Microsystems Inc.','name'=>'CORSAIR XMS 2GB (2 x 1GB) 184-Pin DDR SDRAM Unbuffered DDR 400 (PC 3200) Dual Channel Kit System Memory - Retail','popularity'=>5,'price'=>185.0,'sku'=>'TWINX2048-3200PRO','timestamp'=>'2008-11-21T17:21:55.706Z','cat'=>['electronics','memory'],'spell'=>['CORSAIR XMS 2GB (2 x 1GB) 184-Pin DDR SDRAM Unbuffered DDR 400 (PC 3200) Dual Channel Kit System Memory - Retail'],'features'=>['CAS latency 2, 2-3-3-6 timing, 2.75v, unbuffered, heat-spreader']},
|
|
25
|
+
{'id'=>'VS1GB400C3','inStock'=>true,'manu'=>'Corsair Microsystems Inc.','name'=>'CORSAIR ValueSelect 1GB 184-Pin DDR SDRAM Unbuffered DDR 400 (PC 3200) System Memory - Retail','popularity'=>7,'price'=>74.99,'sku'=>'VS1GB400C3','timestamp'=>'2008-11-21T17:21:55.71Z','cat'=>['electronics','memory'],'spell'=>['CORSAIR ValueSelect 1GB 184-Pin DDR SDRAM Unbuffered DDR 400 (PC 3200) System Memory - Retail']},
|
|
26
|
+
{'id'=>'VDBDB1A16','inStock'=>true,'manu'=>'A-DATA Technology Inc.','name'=>'A-DATA V-Series 1GB 184-Pin DDR SDRAM Unbuffered DDR 400 (PC 3200) System Memory - OEM','popularity'=>5,'sku'=>'VDBDB1A16','timestamp'=>'2008-11-21T17:21:55.712Z','cat'=>['electronics','memory'],'spell'=>['A-DATA V-Series 1GB 184-Pin DDR SDRAM Unbuffered DDR 400 (PC 3200) System Memory - OEM'],'features'=>['CAS latency 3, 2.7v']},
|
|
27
|
+
{'id'=>'3007WFP','inStock'=>true,'includes'=>'USB cable','manu'=>'Dell, Inc.','name'=>'Dell Widescreen UltraSharp 3007WFP','popularity'=>6,'price'=>2199.0,'sku'=>'3007WFP','timestamp'=>'2008-11-21T17:21:55.724Z','weight'=>401.6,'cat'=>['electronics','monitor'],'spell'=>['Dell Widescreen UltraSharp 3007WFP'],'features'=>['30" TFT active matrix LCD, 2560 x 1600, .25mm dot pitch, 700:1 contrast']},
|
|
28
|
+
{'id'=>'VA902B','inStock'=>true,'manu'=>'ViewSonic Corp.','name'=>'ViewSonic VA902B - flat panel display - TFT - 19"','popularity'=>6,'price'=>279.95,'sku'=>'VA902B','timestamp'=>'2008-11-21T17:21:55.734Z','weight'=>190.4,'cat'=>['electronics','monitor'],'spell'=>['ViewSonic VA902B - flat panel display - TFT - 19"'],'features'=>['19" TFT active matrix LCD, 8ms response time, 1280 x 1024 native resolution']}]
|
|
29
|
+
}
|
|
30
|
+
}
|
|
31
|
+
end
|