nokogiri 1.10.8-java → 1.10.9-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a128fdc76b3bc96899e22fed66f613f990e3c4736d4b0cc7c243a3a19182bf9
-  data.tar.gz: 6f8b1afb5e1ac41f49740b77bd908a7b7405d6425b23b756dc3cbb816f4a8970
+  metadata.gz: 30b45e844544b442de9e1b6e0d7563366691987d706c644852ac2a43b98e21aa
+  data.tar.gz: 72a92174b6c7212e855d5ad837a6a057aa037e787c1a5bfbafc51b01e4bcc005
 SHA512:
-  metadata.gz: 62b71a0ee6624bb44cb631f7ab887ad48c5c55bd25d9b040b2da553aa364a737fbc5fe1de61f2ef4fd86a8e80789df880dce056fc0423be56d57a968ae593172
-  data.tar.gz: 3d0f696d04cf4ae54c9202e7e3575d0bb6e6ba6217a39d8cba714ad0ef395f1a1022b19d509c7efe96c48103badf9b5a355d04e93aeebefab4afe7767af1393e
+  metadata.gz: 5a73e36df6a440644e9597b17d6d981fe04b2dbd4487b69491eaff3501f503e181c33f5531b8fdca363c52789ad211b5a05c70f4a78eddd7819ad0ecd506b892
+  data.tar.gz: e6b1bb8a4a6a499a893db8df894fd88eb4f90c9b819ec2317a824d50054dfbbaa6cc5af957d22d554cd2d9a6c96d5755ef407eca4d524a54cbd8878e7a1ad3df

data/ext/java/nokogiri/XmlNodeSet.java

@@ -39,6 +39,7 @@ import static nokogiri.internals.NokogiriHelpers.nodeListToRubyArray;
 import java.util.Arrays;
 
 import org.jruby.Ruby;
+import org.jruby.RubyArray;
 import org.jruby.RubyClass;
 import org.jruby.RubyFixnum;
 import org.jruby.RubyObject;
@@ -391,7 +392,7 @@ outer:
     }
 
     @JRubyMethod(name = {"to_a", "to_ary"})
-    public IRubyObject to_a(ThreadContext context) {
+    public RubyArray to_a(ThreadContext context) {
         return context.runtime.newArrayNoCopy(nodes);
     }
 

data/ext/nokogiri/xml_schema.c

@@ -133,6 +133,31 @@ static VALUE read_memory(VALUE klass, VALUE content)
   return rb_schema;
 }
 
+/* Schema creation will remove and deallocate "blank" nodes.
+ * If those blank nodes have been exposed to Ruby, they could get freed
+ * out from under the VALUE pointer.  This function checks to see if any of
+ * those nodes have been exposed to Ruby, and if so we should raise an exception.
+ */
+static int has_blank_nodes_p(VALUE cache)
+{
+    long i;
+
+    if (NIL_P(cache)) {
+        return 0;
+    }
+
+    for (i = 0; i < RARRAY_LEN(cache); i++) {
+        xmlNodePtr node;
+        VALUE element = rb_ary_entry(cache, i);
+        Data_Get_Struct(element, xmlNode, node);
+        if (xmlIsBlankNode(node)) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
 /*
  * call-seq:
  *  from_document(doc)
@@ -152,6 +177,10 @@ static VALUE from_document(VALUE klass, VALUE document)
   /* In case someone passes us a node. ugh. */
   doc = doc->doc;
 
+  if (has_blank_nodes_p(DOC_NODE_CACHE(doc))) {
+    rb_raise(rb_eArgError, "Creating a schema from a document that has blank nodes exposed to Ruby is dangerous");
+  }
+
   ctx = xmlSchemaNewDocParserCtxt(doc);
 
   errors = rb_ary_new();

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = "1.10.8"
+  VERSION = "1.10.9"
 
   class VersionInfo # :nodoc:
     def jruby?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.10.8
+  version: 1.10.9
 platform: java
 authors:
 - Aaron Patterson
@@ -14,7 +14,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-02-10 00:00:00.000000000 Z
+date: 2020-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement