nokogiri 1.18.7 → 1.18.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. checksums.yaml +4 -4
  2. data/dependencies.yml +3 -3
  3. data/lib/nokogiri/version/constant.rb +1 -1
  4. data/patches/libxml2/0020-CVE-2025-6021-tree-Fix-integer-overflow-in-xmlBuildQ.patch +54 -0
  5. data/patches/libxml2/0021-CVE-2025-6170-Fix-potential-buffer-overflows-of-inte.patch +102 -0
  6. data/patches/libxml2/0022-CVE-2025-49795-schematron-Fix-null-pointer-dereferen.patch +69 -0
  7. data/patches/libxml2/0023-CVE-2025-49794-CVE-2025-49796-schematron-Fix-xmlSche.patch +182 -0
  8. data/ports/archives/libxml2-2.13.8.tar.xz +0 -0
  9. metadata +9 -5
  10. data/ports/archives/libxml2-2.13.7.tar.xz +0 -0
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: e8955e1010e2fd456ffa2ffc7d14808ccb539b0e0190d2e5d5389b2d52cf509b
4
- data.tar.gz: b7c3fb55244a74192bea9c32ff5a984a6d1952d850c99816db268bbdd3e0a5c8
3
+ metadata.gz: 2e172a06a5a69eb0ed0203096425f18ffbe6c079a5a179b1760684e0717ec875
4
+ data.tar.gz: ba4805c9b64fdde8aeaacaadf0175ebcc8c4eed9d3cbd1b0e2c14699e4dd2901
5
5
  SHA512:
6
- metadata.gz: 175a5a434c88bfb3df0e6b2711d1b5afc24e480dbc4699fa35d91b21183937b9eddb347da96d5f52efbd8a96cdc24d6b0605d1ef722aae53331a5321b8231710
7
- data.tar.gz: 4b3692c9b7afb27a6a5f5c41bdcabadf460a3deb5d1a7fe53a7f6f21fb73a22c84e592ca230db031c36acca0c5d6c036a06f1d394af7c51a1df0b2fd555ad5a3
6
+ metadata.gz: 5a1bc7b561ea0c93a1d9d56c1f5f3d0cf6ec5014f7c51b3661b4881d8fc6d9f98e309a7d1659dbd84674defdc692f9337d6dff3fd65cc90b42f0f2a9ef7b407e
7
+ data.tar.gz: 3bbb0472af4cf797859667683b46ec7f647eba86680f19f59dda45a9571b861b8a21680318d5f5cac307b71545f19759b805aa07dc8ca4b9ab21d3d980607222
data/dependencies.yml CHANGED
@@ -1,8 +1,8 @@
1
1
  ---
2
2
  libxml2:
3
- version: "2.13.7"
4
- sha256: "14796d24402108e99d8de4e974d539bed62e23af8c4233317274ce073ceff93b"
5
- # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.7.sha256sum
3
+ version: "2.13.8"
4
+ sha256: "277294cb33119ab71b2bc81f2f445e9bc9435b893ad15bb2cd2b0e859a0ee84a"
5
+ # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.8.sha256sum
6
6
 
7
7
  libxslt:
8
8
  version: "1.1.43"
data/lib/nokogiri/version/constant.rb CHANGED
@@ -2,5 +2,5 @@
2
2
 
3
3
  module Nokogiri
4
4
  # The version of Nokogiri you are using
5
- VERSION = "1.18.7"
5
+ VERSION = "1.18.9"
6
6
  end
data/patches/libxml2/0020-CVE-2025-6021-tree-Fix-integer-overflow-in-xmlBuildQ.patch ADDED
@@ -0,0 +1,54 @@
1
+ From 17d950ae33c23f87692aa179bacedb6743f3188a Mon Sep 17 00:00:00 2001
2
+ From: Nick Wellnhofer <wellnhofer@aevum.de>
3
+ Date: Tue, 27 May 2025 12:53:17 +0200
4
+ Subject: [PATCH 5/9] [CVE-2025-6021] tree: Fix integer overflow in
5
+ xmlBuildQName
6
+
7
+ Fixes #926.
8
+ ---
9
+ tree.c | 12 +++++++++---
10
+ 1 file changed, 9 insertions(+), 3 deletions(-)
11
+
12
+ diff --git a/tree.c b/tree.c
13
+ index f097cf87..5bc95b8a 100644
14
+ --- a/tree.c
15
+ +++ b/tree.c
16
+ @@ -47,6 +47,10 @@
17
+ #include "private/error.h"
18
+ #include "private/tree.h"
19
+
20
+ +#ifndef SIZE_MAX
21
+ + #define SIZE_MAX ((size_t)-1)
22
+ +#endif
23
+ +
24
+ int __xmlRegisterCallbacks = 0;
25
+
26
+ /************************************************************************
27
+ @@ -167,10 +171,10 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
28
+ xmlChar *
29
+ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
30
+ xmlChar *memory, int len) {
31
+ - int lenn, lenp;
32
+ + size_t lenn, lenp;
33
+ xmlChar *ret;
34
+
35
+ - if (ncname == NULL) return(NULL);
36
+ + if ((ncname == NULL) || (len < 0)) return(NULL);
37
+ if (prefix == NULL) return((xmlChar *) ncname);
38
+
39
+ #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
40
+ @@ -181,8 +185,10 @@ xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
41
+
42
+ lenn = strlen((char *) ncname);
43
+ lenp = strlen((char *) prefix);
44
+ + if (lenn >= SIZE_MAX - lenp - 1)
45
+ + return(NULL);
46
+
47
+ - if ((memory == NULL) || (len < lenn + lenp + 2)) {
48
+ + if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
49
+ ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
50
+ if (ret == NULL)
51
+ return(NULL);
52
+ --
53
+ 2.50.1
54
+
data/patches/libxml2/0021-CVE-2025-6170-Fix-potential-buffer-overflows-of-inte.patch ADDED
@@ -0,0 +1,102 @@
1
+ From 5e9ec5c107d3f5b5179c3dbc19df43df041cd55b Mon Sep 17 00:00:00 2001
2
+ From: Michael Mann <mmann78@netscape.net>
3
+ Date: Fri, 20 Jun 2025 23:05:00 -0400
4
+ Subject: [PATCH 6/9] [CVE-2025-6170] Fix potential buffer overflows of
5
+ interactive shell
6
+
7
+ Fixes #941
8
+ ---
9
+ debugXML.c | 15 ++++++++++-----
10
+ result/scripts/long_command | 8 ++++++++
11
+ test/scripts/long_command.script | 6 ++++++
12
+ test/scripts/long_command.xml | 1 +
13
+ 4 files changed, 25 insertions(+), 5 deletions(-)
14
+ create mode 100644 result/scripts/long_command
15
+ create mode 100644 test/scripts/long_command.script
16
+ create mode 100644 test/scripts/long_command.xml
17
+
18
+ diff --git a/debugXML.c b/debugXML.c
19
+ index ed56b0f8..452b9573 100644
20
+ --- a/debugXML.c
21
+ +++ b/debugXML.c
22
+ @@ -1033,6 +1033,10 @@ xmlCtxtDumpOneNode(xmlDebugCtxtPtr ctxt, xmlNodePtr node)
23
+ xmlCtxtGenericNodeCheck(ctxt, node);
24
+ }
25
+
26
+ +#define MAX_PROMPT_SIZE 500
27
+ +#define MAX_ARG_SIZE 400
28
+ +#define MAX_COMMAND_SIZE 100
29
+ +
30
+ /**
31
+ * xmlCtxtDumpNode:
32
+ * @output: the FILE * for the output
33
+ @@ -2795,10 +2799,10 @@ void
34
+ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
35
+ FILE * output)
36
+ {
37
+ - char prompt[500] = "/ > ";
38
+ + char prompt[MAX_PROMPT_SIZE] = "/ > ";
39
+ char *cmdline = NULL, *cur;
40
+ - char command[100];
41
+ - char arg[400];
42
+ + char command[MAX_COMMAND_SIZE];
43
+ + char arg[MAX_ARG_SIZE];
44
+ int i;
45
+ xmlShellCtxtPtr ctxt;
46
+ xmlXPathObjectPtr list;
47
+ @@ -2856,7 +2860,8 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
48
+ cur++;
49
+ i = 0;
50
+ while ((*cur != ' ') && (*cur != '\t') &&
51
+ - (*cur != '\n') && (*cur != '\r')) {
52
+ + (*cur != '\n') && (*cur != '\r') &&
53
+ + (i < (MAX_COMMAND_SIZE - 1))) {
54
+ if (*cur == 0)
55
+ break;
56
+ command[i++] = *cur++;
57
+ @@ -2871,7 +2876,7 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
58
+ while ((*cur == ' ') || (*cur == '\t'))
59
+ cur++;
60
+ i = 0;
61
+ - while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
62
+ + while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
63
+ if (*cur == 0)
64
+ break;
65
+ arg[i++] = *cur++;
66
+ diff --git a/result/scripts/long_command b/result/scripts/long_command
67
+ new file mode 100644
68
+ index 00000000..e6f00708
69
+ --- /dev/null
70
+ +++ b/result/scripts/long_command
71
+ @@ -0,0 +1,8 @@
72
+ +/ > b > b > Object is a Node Set :
73
+ +Set contains 1 nodes:
74
+ +1 ELEMENT a:c
75
+ +b > Unknown command This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_comm
76
+ +b > b > Unknown command ess_currents_of_time_and_existence
77
+ +b > <?xml version="1.0"?>
78
+ +<a xmlns:a="bar"><b xmlns:a="foo">Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_prof</b></a>
79
+ +b >
80
+
81
+ diff --git a/test/scripts/long_command.script b/test/scripts/long_command.script
82
+ new file mode 100644
83
+ index 00000000..00f6df09
84
+ --- /dev/null
85
+ +++ b/test/scripts/long_command.script
86
+ @@ -0,0 +1,6 @@
87
+ +cd a/b
88
+ +set <a:c/>
89
+ +xpath //*[namespace-uri()="foo"]
90
+ +This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_command_please_dont_crash foo
91
+ +set Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_profound_emotion_and_every_grand_aspiration_that_propels_our_species_ever_onward_through_the_relentless_currents_of_time_and_existence
92
+ +save -
93
+ diff --git a/test/scripts/long_command.xml b/test/scripts/long_command.xml
94
+ new file mode 100644
95
+ index 00000000..1ba44016
96
+ --- /dev/null
97
+ +++ b/test/scripts/long_command.xml
98
+ @@ -0,0 +1 @@
99
+ +<a xmlns:a="bar"><b xmlns:a="foo"/></a>
100
+ --
101
+ 2.50.1
102
+
data/patches/libxml2/0022-CVE-2025-49795-schematron-Fix-null-pointer-dereferen.patch ADDED
@@ -0,0 +1,69 @@
1
+ From 62048278a4c5fdf14d287dfb400005c0a0caa69f Mon Sep 17 00:00:00 2001
2
+ From: Michael Mann <mmann78@netscape.net>
3
+ Date: Sat, 21 Jun 2025 12:11:30 -0400
4
+ Subject: [PATCH 7/9] [CVE-2025-49795] schematron: Fix null pointer dereference
5
+ leading to DoS
6
+
7
+ Fixes #932
8
+ ---
9
+ result/schematron/zvon16_0.err | 3 +++
10
+ schematron.c | 5 +++++
11
+ test/schematron/zvon16.sct | 7 +++++++
12
+ test/schematron/zvon16_0.xml | 5 +++++
13
+ 4 files changed, 20 insertions(+)
14
+ create mode 100644 result/schematron/zvon16_0.err
15
+ create mode 100644 test/schematron/zvon16.sct
16
+ create mode 100644 test/schematron/zvon16_0.xml
17
+
18
+ diff --git a/result/schematron/zvon16_0.err b/result/schematron/zvon16_0.err
19
+ new file mode 100644
20
+ index 00000000..3d052409
21
+ --- /dev/null
22
+ +++ b/result/schematron/zvon16_0.err
23
+ @@ -0,0 +1,3 @@
24
+ +XPath error : Unregistered function
25
+ +./test/schematron/zvon16_0.xml:2: element book: schematron error : /library/book line 2: Book
26
+ +./test/schematron/zvon16_0.xml fails to validate
27
+ diff --git a/schematron.c b/schematron.c
28
+ index 1de25deb..da603402 100644
29
+ --- a/schematron.c
30
+ +++ b/schematron.c
31
+ @@ -1506,6 +1506,11 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
32
+ select = xmlGetNoNsProp(child, BAD_CAST "select");
33
+ comp = xmlXPathCtxtCompile(ctxt->xctxt, select);
34
+ eval = xmlXPathCompiledEval(comp, ctxt->xctxt);
35
+ + if (eval == NULL) {
36
+ + xmlXPathFreeCompExpr(comp);
37
+ + xmlFree(select);
38
+ + return ret;
39
+ + }
40
+
41
+ switch (eval->type) {
42
+ case XPATH_NODESET: {
43
+ diff --git a/test/schematron/zvon16.sct b/test/schematron/zvon16.sct
44
+ new file mode 100644
45
+ index 00000000..f03848aa
46
+ --- /dev/null
47
+ +++ b/test/schematron/zvon16.sct
48
+ @@ -0,0 +1,7 @@
49
+ +<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
50
+ + <sch:pattern id="TestPattern">
51
+ + <sch:rule context="book">
52
+ + <sch:report test="not(@available)">Book <sch:value-of select="falae()"/> test</sch:report>
53
+ + </sch:rule>
54
+ + </sch:pattern>
55
+ +</sch:schema>
56
+ diff --git a/test/schematron/zvon16_0.xml b/test/schematron/zvon16_0.xml
57
+ new file mode 100644
58
+ index 00000000..551e2d65
59
+ --- /dev/null
60
+ +++ b/test/schematron/zvon16_0.xml
61
+ @@ -0,0 +1,5 @@
62
+ +<library>
63
+ + <book title="Test Book" id="bk101">
64
+ + <author>Test Author</author>
65
+ + </book>
66
+ +</library>
67
+ --
68
+ 2.50.1
69
+
data/patches/libxml2/0023-CVE-2025-49794-CVE-2025-49796-schematron-Fix-xmlSche.patch ADDED
@@ -0,0 +1,182 @@
1
+ From 81cef8c5b5aec2acdf5707e57a6db0c8d1d0abca Mon Sep 17 00:00:00 2001
2
+ From: Nick Wellnhofer <wellnhofer@aevum.de>
3
+ Date: Fri, 4 Jul 2025 14:28:26 +0200
4
+ Subject: [PATCH 8/9] [CVE-2025-49794] [CVE-2025-49796] schematron: Fix
5
+ xmlSchematronReportOutput
6
+
7
+ Fix use-after-free (CVE-2025-49794) and type confusion (CVE-2025-49796)
8
+ in xmlSchematronReportOutput.
9
+
10
+ Fixes #931.
11
+ Fixes #933.
12
+ ---
13
+ result/schematron/cve-2025-49794_0.err | 2 ++
14
+ result/schematron/cve-2025-49796_0.err | 2 ++
15
+ schematron.c | 49 ++++++++++++++------------
16
+ test/schematron/cve-2025-49794.sct | 10 ++++++
17
+ test/schematron/cve-2025-49794_0.xml | 6 ++++
18
+ test/schematron/cve-2025-49796.sct | 9 +++++
19
+ test/schematron/cve-2025-49796_0.xml | 3 ++
20
+ 7 files changed, 58 insertions(+), 23 deletions(-)
21
+ create mode 100644 result/schematron/cve-2025-49794_0.err
22
+ create mode 100644 result/schematron/cve-2025-49796_0.err
23
+ create mode 100644 test/schematron/cve-2025-49794.sct
24
+ create mode 100644 test/schematron/cve-2025-49794_0.xml
25
+ create mode 100644 test/schematron/cve-2025-49796.sct
26
+ create mode 100644 test/schematron/cve-2025-49796_0.xml
27
+
28
+ diff --git a/result/schematron/cve-2025-49794_0.err b/result/schematron/cve-2025-49794_0.err
29
+ new file mode 100644
30
+ index 00000000..57752310
31
+ --- /dev/null
32
+ +++ b/result/schematron/cve-2025-49794_0.err
33
+ @@ -0,0 +1,2 @@
34
+ +./test/schematron/cve-2025-49794_0.xml:2: element boo0: schematron error : /librar0/boo0 line 2:
35
+ +./test/schematron/cve-2025-49794_0.xml fails to validate
36
+ diff --git a/result/schematron/cve-2025-49796_0.err b/result/schematron/cve-2025-49796_0.err
37
+ new file mode 100644
38
+ index 00000000..bf875ee0
39
+ --- /dev/null
40
+ +++ b/result/schematron/cve-2025-49796_0.err
41
+ @@ -0,0 +1,2 @@
42
+ +./test/schematron/cve-2025-49796_0.xml:2: element boo0: schematron error : /librar0/boo0 line 2:
43
+ +./test/schematron/cve-2025-49796_0.xml fails to validate
44
+ diff --git a/schematron.c b/schematron.c
45
+ index da603402..6e2ceeb7 100644
46
+ --- a/schematron.c
47
+ +++ b/schematron.c
48
+ @@ -1414,27 +1414,15 @@ xmlSchematronParse(xmlSchematronParserCtxtPtr ctxt)
49
+ * *
50
+ ************************************************************************/
51
+
52
+ -static xmlNodePtr
53
+ +static xmlXPathObjectPtr
54
+ xmlSchematronGetNode(xmlSchematronValidCtxtPtr ctxt,
55
+ xmlNodePtr cur, const xmlChar *xpath) {
56
+ - xmlNodePtr node = NULL;
57
+ - xmlXPathObjectPtr ret;
58
+ -
59
+ if ((ctxt == NULL) || (cur == NULL) || (xpath == NULL))
60
+ return(NULL);
61
+
62
+ ctxt->xctxt->doc = cur->doc;
63
+ ctxt->xctxt->node = cur;
64
+ - ret = xmlXPathEval(xpath, ctxt->xctxt);
65
+ - if (ret == NULL)
66
+ - return(NULL);
67
+ -
68
+ - if ((ret->type == XPATH_NODESET) &&
69
+ - (ret->nodesetval != NULL) && (ret->nodesetval->nodeNr > 0))
70
+ - node = ret->nodesetval->nodeTab[0];
71
+ -
72
+ - xmlXPathFreeObject(ret);
73
+ - return(node);
74
+ + return(xmlXPathEval(xpath, ctxt->xctxt));
75
+ }
76
+
77
+ /**
78
+ @@ -1480,25 +1468,40 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
79
+ (child->type == XML_CDATA_SECTION_NODE))
80
+ ret = xmlStrcat(ret, child->content);
81
+ else if (IS_SCHEMATRON(child, "name")) {
82
+ + xmlXPathObject *obj = NULL;
83
+ xmlChar *path;
84
+
85
+ path = xmlGetNoNsProp(child, BAD_CAST "path");
86
+
87
+ node = cur;
88
+ if (path != NULL) {
89
+ - node = xmlSchematronGetNode(ctxt, cur, path);
90
+ - if (node == NULL)
91
+ - node = cur;
92
+ + obj = xmlSchematronGetNode(ctxt, cur, path);
93
+ + if ((obj != NULL) &&
94
+ + (obj->type == XPATH_NODESET) &&
95
+ + (obj->nodesetval != NULL) &&
96
+ + (obj->nodesetval->nodeNr > 0))
97
+ + node = obj->nodesetval->nodeTab[0];
98
+ xmlFree(path);
99
+ }
100
+
101
+ - if ((node->ns == NULL) || (node->ns->prefix == NULL))
102
+ - ret = xmlStrcat(ret, node->name);
103
+ - else {
104
+ - ret = xmlStrcat(ret, node->ns->prefix);
105
+ - ret = xmlStrcat(ret, BAD_CAST ":");
106
+ - ret = xmlStrcat(ret, node->name);
107
+ + switch (node->type) {
108
+ + case XML_ELEMENT_NODE:
109
+ + case XML_ATTRIBUTE_NODE:
110
+ + if ((node->ns == NULL) || (node->ns->prefix == NULL))
111
+ + ret = xmlStrcat(ret, node->name);
112
+ + else {
113
+ + ret = xmlStrcat(ret, node->ns->prefix);
114
+ + ret = xmlStrcat(ret, BAD_CAST ":");
115
+ + ret = xmlStrcat(ret, node->name);
116
+ + }
117
+ + break;
118
+ +
119
+ + /* TODO: handle other node types */
120
+ + default:
121
+ + break;
122
+ }
123
+ +
124
+ + xmlXPathFreeObject(obj);
125
+ } else if (IS_SCHEMATRON(child, "value-of")) {
126
+ xmlChar *select;
127
+ xmlXPathObjectPtr eval;
128
+ diff --git a/test/schematron/cve-2025-49794.sct b/test/schematron/cve-2025-49794.sct
129
+ new file mode 100644
130
+ index 00000000..7fc9ee3d
131
+ --- /dev/null
132
+ +++ b/test/schematron/cve-2025-49794.sct
133
+ @@ -0,0 +1,10 @@
134
+ +<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
135
+ + <sch:pattern id="">
136
+ + <sch:rule context="boo0">
137
+ + <sch:report test="not(0)">
138
+ + <sch:name path="&#9;e|namespace::*|e"/>
139
+ + </sch:report>
140
+ + <sch:report test="0"></sch:report>
141
+ + </sch:rule>
142
+ + </sch:pattern>
143
+ +</sch:schema>
144
+ diff --git a/test/schematron/cve-2025-49794_0.xml b/test/schematron/cve-2025-49794_0.xml
145
+ new file mode 100644
146
+ index 00000000..debc64ba
147
+ --- /dev/null
148
+ +++ b/test/schematron/cve-2025-49794_0.xml
149
+ @@ -0,0 +1,6 @@
150
+ +<librar0>
151
+ + <boo0 t="">
152
+ + <author></author>
153
+ + </boo0>
154
+ + <ins></ins>
155
+ +</librar0>
156
+ diff --git a/test/schematron/cve-2025-49796.sct b/test/schematron/cve-2025-49796.sct
157
+ new file mode 100644
158
+ index 00000000..e9702d75
159
+ --- /dev/null
160
+ +++ b/test/schematron/cve-2025-49796.sct
161
+ @@ -0,0 +1,9 @@
162
+ +<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
163
+ + <sch:pattern id="">
164
+ + <sch:rule context="boo0">
165
+ + <sch:report test="not(0)">
166
+ + <sch:name path="/"/>
167
+ + </sch:report>
168
+ + </sch:rule>
169
+ + </sch:pattern>
170
+ +</sch:schema>
171
+ diff --git a/test/schematron/cve-2025-49796_0.xml b/test/schematron/cve-2025-49796_0.xml
172
+ new file mode 100644
173
+ index 00000000..be33c4ec
174
+ --- /dev/null
175
+ +++ b/test/schematron/cve-2025-49796_0.xml
176
+ @@ -0,0 +1,3 @@
177
+ +<librar0>
178
+ + <boo0/>
179
+ +</librar0>
180
+ --
181
+ 2.50.1
182
+
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: nokogiri
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.18.7
4
+ version: 1.18.9
5
5
  platform: ruby
6
6
  authors:
7
7
  - Mike Dalessio
@@ -19,7 +19,7 @@ authors:
19
19
  - Nobuyoshi Nakada
20
20
  bindir: bin
21
21
  cert_chain: []
22
- date: 2025-03-31 00:00:00.000000000 Z
22
+ date: 1980-01-02 00:00:00.000000000 Z
23
23
  dependencies:
24
24
  - !ruby/object:Gem::Dependency
25
25
  name: mini_portile2
@@ -59,6 +59,7 @@ executables:
59
59
  extensions:
60
60
  - ext/nokogiri/extconf.rb
61
61
  extra_rdoc_files:
62
+ - README.md
62
63
  - ext/nokogiri/gumbo.c
63
64
  - ext/nokogiri/html4_document.c
64
65
  - ext/nokogiri/html4_element_description.c
@@ -95,7 +96,6 @@ extra_rdoc_files:
95
96
  - ext/nokogiri/xml_text.c
96
97
  - ext/nokogiri/xml_xpath_context.c
97
98
  - ext/nokogiri/xslt_stylesheet.c
98
- - README.md
99
99
  files:
100
100
  - Gemfile
101
101
  - LICENSE-DEPENDENCIES.md
@@ -272,8 +272,12 @@ files:
272
272
  - patches/libxml2/0010-update-config.guess-and-config.sub-for-libxml2.patch
273
273
  - patches/libxml2/0011-rip-out-libxml2-s-libc_single_threaded-support.patch
274
274
  - patches/libxml2/0019-xpath-Use-separate-static-hash-table-for-standard-fu.patch
275
+ - patches/libxml2/0020-CVE-2025-6021-tree-Fix-integer-overflow-in-xmlBuildQ.patch
276
+ - patches/libxml2/0021-CVE-2025-6170-Fix-potential-buffer-overflows-of-inte.patch
277
+ - patches/libxml2/0022-CVE-2025-49795-schematron-Fix-null-pointer-dereferen.patch
278
+ - patches/libxml2/0023-CVE-2025-49794-CVE-2025-49796-schematron-Fix-xmlSche.patch
275
279
  - patches/libxslt/0001-update-config.guess-and-config.sub-for-libxslt.patch
276
- - ports/archives/libxml2-2.13.7.tar.xz
280
+ - ports/archives/libxml2-2.13.8.tar.xz
277
281
  - ports/archives/libxslt-1.1.43.tar.xz
278
282
  homepage: https://nokogiri.org
279
283
  licenses:
@@ -301,7 +305,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
301
305
  - !ruby/object:Gem::Version
302
306
  version: '0'
303
307
  requirements: []
304
- rubygems_version: 3.6.2
308
+ rubygems_version: 3.6.9
305
309
  specification_version: 4
306
310
  summary: Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.
307
311
  test_files: []
data/ports/archives/libxml2-2.13.7.tar.xz DELETED
Binary file