nokogiri 1.5.4.rc1-java → 1.5.4.rc2-java

data/CHANGELOG.ja.rdoc

@@ -10,6 +10,9 @@
 
   * Segmentation fault when creating a comment node for a DocumentFragment. #677, #678.
   * Treat '.' as xpath in at() and search(). #690
+  * [MRI] [Security] Default parse options for XML documents were
+    changed to not make network connections during document parsing,
+    to avoid XXE vulnerability. #693
 
 
 == 1.5.3 / 2012-06-01

data/CHANGELOG.rdoc

@@ -2,7 +2,7 @@
 
 * Features
 
-  * The "nokogiri" script now has more verbose output when passed the `--rng` option. (Thanks, Dan Radez!)
+  * The "nokogiri" script now has more verbose output when passed the `--rng` option. #675 (Thanks, Dan Radez!)
   * Build support on hardened Debian systems that use `-Werror=format-security`. #680.
   * Better build support for systems with pkg-config. #584
 
@@ -10,7 +10,9 @@
 
   * Segmentation fault when creating a comment node for a DocumentFragment. #677, #678.
   * Treat '.' as xpath in at() and search(). #690
-
+  * [MRI] [Security] Default parse options for XML documents were
+    changed to not make network connections during document parsing,
+    to avoid XXE vulnerability. #693
 
 == 1.5.3 / 2012-06-01
 

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = '1.5.4.rc1'
+  VERSION = '1.5.4.rc2'
 
   class VersionInfo # :nodoc:
     def jruby?

data/lib/nokogiri/xml/parse_options.rb

@@ -47,7 +47,7 @@ module Nokogiri
       HUGE        = 1 << 19
 
       # the default options used for parsing XML documents
-      DEFAULT_XML  = RECOVER
+      DEFAULT_XML  = RECOVER | NONET
       # the default options used for parsing HTML documents
       DEFAULT_HTML = RECOVER | NOERROR | NOWARNING | NONET
 
@@ -64,6 +64,11 @@ module Nokogiri
             self
           end
 
+          def no#{constant.downcase}
+            @options &= ~#{constant}
+            self
+          end
+
           def #{constant.downcase}?
             #{constant} & @options == #{constant}
           end

data/test/xml/test_parse_options.rb

@@ -35,6 +35,18 @@ module Nokogiri
         assert_equal 1 << 1, options.options
       end
 
+      def test_unsetting
+        options = Nokogiri::XML::ParseOptions.new Nokogiri::XML::ParseOptions::DEFAULT_HTML
+        assert options.nonet?
+        assert options.recover?
+        options.nononet.norecover
+        assert ! options.nonet?
+        assert ! options.recover?
+        options.nonet.recover
+        assert options.nonet?
+        assert options.recover?
+      end
+
       def test_chaining
         options = Nokogiri::XML::ParseOptions.new.recover.noent
         assert options.recover?

metadata

@@ -2,7 +2,7 @@
 name: nokogiri
 version: !ruby/object:Gem::Version 
   prerelease: 6
-  version: 1.5.4.rc1
+  version: 1.5.4.rc2
 platform: java
 authors: 
   - Aaron Patterson
@@ -12,7 +12,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-06-07 00:00:00 Z
+date: 2012-06-08 00:00:00 Z
 dependencies: 
   - !ruby/object:Gem::Dependency 
     name: hoe-bundler