nokogiri 1.10.2-x86-mingw32 → 1.10.3-x86-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: afaf886be96511b5401a44a8220acd474e333d87f7b2aa4ef9e6cdcd632ae9c3
-  data.tar.gz: e92e1f52c6407f27c81cd2c723d54446b5748ea0a338112e73a7444ba2c3e525
+  metadata.gz: be404b59e382195664fee52bb59899ba32bd108075d7ed8dd81f31d1fa1bc34b
+  data.tar.gz: de58825cac3a1f43a65f5d4525c7d396309565643759f1c3c01d3439aa568599
 SHA512:
-  metadata.gz: f580aa238bbf083738627aaa0c45085f7a167ec5b4d90ecb51dd3b3db628a05f991e2bf1aa6fda5d909f6c3f9270981a0b4c88213466d28d78b9c5196bb2d7dc
-  data.tar.gz: a0a010ea578f5ed4cf0afedc505049a9bd0fe6db1dad01637af57d477eb9e7c331f9e7e84eb1889506e3a06fbe31e58ab5f39e143aad254bc055b0b3536ee455
+  metadata.gz: 926b5e05e649eabf50d7c847d9d96af6c1ef6261c1f5e0ef4cf540aed3fabb1d0a0ad1f9772fcd4efaee16552e58fa6f3a04b7e36bafee56262a9e073cda786b
+  data.tar.gz: cc8cc08837088f89e60a4f5eed718392b31c5b63c4bbc88c4a7c516786c06cb76fd498bde954ecda69d515fc958f8c1cdeffd855839322c53ca9ba5b77f1c7c5

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = "1.10.2"
+  VERSION = "1.10.3"
 
   class VersionInfo # :nodoc:
     def jruby?
@@ -8,7 +8,7 @@ module Nokogiri
     end
 
     def engine
-      defined?(RUBY_ENGINE) ? RUBY_ENGINE : 'mri'
+      defined?(RUBY_ENGINE) ? RUBY_ENGINE : "mri"
     end
 
     def loaded_parser_version
@@ -27,7 +27,7 @@ module Nokogiri
     end
 
     def libxml2_using_system?
-      ! libxml2_using_packaged?
+      !libxml2_using_packaged?
     end
 
     def libxml2_using_packaged?
@@ -46,33 +46,33 @@ module Nokogiri
 
     def to_hash
       hash_info = {}
-      hash_info['warnings']              = []
-      hash_info['nokogiri']              = Nokogiri::VERSION
-      hash_info['ruby']                  = {}
-      hash_info['ruby']['version']       = ::RUBY_VERSION
-      hash_info['ruby']['platform']      = ::RUBY_PLATFORM
-      hash_info['ruby']['description']   = ::RUBY_DESCRIPTION
-      hash_info['ruby']['engine']        = engine
-      hash_info['ruby']['jruby']         = jruby? if jruby?
+      hash_info["warnings"] = []
+      hash_info["nokogiri"] = Nokogiri::VERSION
+      hash_info["ruby"] = {}
+      hash_info["ruby"]["version"] = ::RUBY_VERSION
+      hash_info["ruby"]["platform"] = ::RUBY_PLATFORM
+      hash_info["ruby"]["description"] = ::RUBY_DESCRIPTION
+      hash_info["ruby"]["engine"] = engine
+      hash_info["ruby"]["jruby"] = jruby? if jruby?
 
       if libxml2?
-        hash_info['libxml']              = {}
-        hash_info['libxml']['binding']   = 'extension'
+        hash_info["libxml"] = {}
+        hash_info["libxml"]["binding"] = "extension"
         if libxml2_using_packaged?
-          hash_info['libxml']['source']  = "packaged"
-          hash_info['libxml']['libxml2_path'] = NOKOGIRI_LIBXML2_PATH
-          hash_info['libxml']['libxslt_path'] = NOKOGIRI_LIBXSLT_PATH
-          hash_info['libxml']['libxml2_patches'] = NOKOGIRI_LIBXML2_PATCHES
-          hash_info['libxml']['libxslt_patches'] = NOKOGIRI_LIBXSLT_PATCHES
+          hash_info["libxml"]["source"] = "packaged"
+          hash_info["libxml"]["libxml2_path"] = NOKOGIRI_LIBXML2_PATH
+          hash_info["libxml"]["libxslt_path"] = NOKOGIRI_LIBXSLT_PATH
+          hash_info["libxml"]["libxml2_patches"] = NOKOGIRI_LIBXML2_PATCHES
+          hash_info["libxml"]["libxslt_patches"] = NOKOGIRI_LIBXSLT_PATCHES
         else
-          hash_info['libxml']['source']  = "system"
+          hash_info["libxml"]["source"] = "system"
         end
-        hash_info['libxml']['compiled']  = compiled_parser_version
-        hash_info['libxml']['loaded']    = loaded_parser_version
-        hash_info['warnings']            = warnings
+        hash_info["libxml"]["compiled"] = compiled_parser_version
+        hash_info["libxml"]["loaded"] = loaded_parser_version
+        hash_info["warnings"] = warnings
       elsif jruby?
-        hash_info['xerces']   = Nokogiri::XERCES_VERSION
-        hash_info['nekohtml'] = Nokogiri::NEKO_VERSION
+        hash_info["xerces"] = Nokogiri::XERCES_VERSION
+        hash_info["nekohtml"] = Nokogiri::NEKO_VERSION
       end
 
       hash_info
@@ -80,10 +80,10 @@ module Nokogiri
 
     def to_markdown
       begin
-        require 'psych'
+        require "psych"
       rescue LoadError
       end
-      require 'yaml'
+      require "yaml"
       "# Nokogiri (#{Nokogiri::VERSION})\n" +
       YAML.dump(to_hash).each_line.map { |line| "    #{line}" }.join
     end

data/patches/libxslt/0001-Fix-security-framework-bypass.patch

@@ -0,0 +1,120 @@
+From e03553605b45c88f0b4b2980adfbbb8f6fca2fd6 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sun, 24 Mar 2019 09:51:39 +0100
+Subject: [PATCH] Fix security framework bypass
+
+xsltCheckRead and xsltCheckWrite return -1 in case of error but callers
+don't check for this condition and allow access. With a specially
+crafted URL, xsltCheckRead could be tricked into returning an error
+because of a supposedly invalid URL that would still be loaded
+succesfully later on.
+
+Fixes #12.
+
+Thanks to Felix Wilhelm for the report.
+---
+ libxslt/documents.c | 18 ++++++++++--------
+ libxslt/imports.c   |  9 +++++----
+ libxslt/transform.c |  9 +++++----
+ libxslt/xslt.c      |  9 +++++----
+ 4 files changed, 25 insertions(+), 20 deletions(-)
+
+diff --git a/libxslt/documents.c b/libxslt/documents.c
+index 3f3a731..4aad11b 100644
+--- a/libxslt/documents.c
++++ b/libxslt/documents.c
+@@ -296,10 +296,11 @@ xsltLoadDocument(xsltTransformContextPtr ctxt, const xmlChar *URI) {
+ 	int res;
+ 
+ 	res = xsltCheckRead(ctxt->sec, ctxt, URI);
+-	if (res == 0) {
+-	    xsltTransformError(ctxt, NULL, NULL,
+-		 "xsltLoadDocument: read rights for %s denied\n",
+-			     URI);
++	if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(ctxt, NULL, NULL,
++                     "xsltLoadDocument: read rights for %s denied\n",
++                                 URI);
+ 	    return(NULL);
+ 	}
+     }
+@@ -372,10 +373,11 @@ xsltLoadStyleDocument(xsltStylesheetPtr style, const xmlChar *URI) {
+ 	int res;
+ 
+ 	res = xsltCheckRead(sec, NULL, URI);
+-	if (res == 0) {
+-	    xsltTransformError(NULL, NULL, NULL,
+-		 "xsltLoadStyleDocument: read rights for %s denied\n",
+-			     URI);
++	if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsltLoadStyleDocument: read rights for %s denied\n",
++                                 URI);
+ 	    return(NULL);
+ 	}
+     }
+diff --git a/libxslt/imports.c b/libxslt/imports.c
+index 874870c..3783b24 100644
+--- a/libxslt/imports.c
++++ b/libxslt/imports.c
+@@ -130,10 +130,11 @@ xsltParseStylesheetImport(xsltStylesheetPtr style, xmlNodePtr cur) {
+ 	int secres;
+ 
+ 	secres = xsltCheckRead(sec, NULL, URI);
+-	if (secres == 0) {
+-	    xsltTransformError(NULL, NULL, NULL,
+-		 "xsl:import: read rights for %s denied\n",
+-			     URI);
++	if (secres <= 0) {
++            if (secres == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsl:import: read rights for %s denied\n",
++                                 URI);
+ 	    goto error;
+ 	}
+     }
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 1379391..0636dbd 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -3493,10 +3493,11 @@ xsltDocumentElem(xsltTransformContextPtr ctxt, xmlNodePtr node,
+      */
+     if (ctxt->sec != NULL) {
+ 	ret = xsltCheckWrite(ctxt->sec, ctxt, filename);
+-	if (ret == 0) {
+-	    xsltTransformError(ctxt, NULL, inst,
+-		 "xsltDocumentElem: write rights for %s denied\n",
+-			     filename);
++	if (ret <= 0) {
++            if (ret == 0)
++                xsltTransformError(ctxt, NULL, inst,
++                     "xsltDocumentElem: write rights for %s denied\n",
++                                 filename);
+ 	    xmlFree(URL);
+ 	    xmlFree(filename);
+ 	    return;
+diff --git a/libxslt/xslt.c b/libxslt/xslt.c
+index 780a5ad..a234eb7 100644
+--- a/libxslt/xslt.c
++++ b/libxslt/xslt.c
+@@ -6763,10 +6763,11 @@ xsltParseStylesheetFile(const xmlChar* filename) {
+ 	int res;
+ 
+ 	res = xsltCheckRead(sec, NULL, filename);
+-	if (res == 0) {
+-	    xsltTransformError(NULL, NULL, NULL,
+-		 "xsltParseStylesheetFile: read rights for %s denied\n",
+-			     filename);
++	if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsltParseStylesheetFile: read rights for %s denied\n",
++                                 filename);
+ 	    return(NULL);
+ 	}
+     }
+-- 
+2.17.1
+

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.10.2
+  version: 1.10.3
 platform: x86-mingw32
 authors:
 - Aaron Patterson
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-25 00:00:00.000000000 Z
+date: 2019-04-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile2
@@ -431,6 +431,7 @@ files:
 - patches/libxml2/0001-Revert-Do-not-URI-escape-in-server-side-includes.patch
 - patches/libxml2/0002-Remove-script-macro-support.patch
 - patches/libxml2/0003-Update-entities-to-remove-handling-of-ssi.patch
+- patches/libxslt/0001-Fix-security-framework-bypass.patch
 homepage: 
 licenses:
 - MIT