nokogiri 1.6.7.2 → 1.6.8.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 44efc9ecb420ea82808bccb3a6483a4c3c495800
-  data.tar.gz: bbe9d9ba340c51db36cd4434b111f983b80c125c
+  metadata.gz: bf3b512e1be5dbcd160d1fdf656009698cc5c168
+  data.tar.gz: 36eefac628cd098846ec6317bf4bdcc6d8fdfdc6
 SHA512:
-  metadata.gz: ce0a7761046a3b8d4dca66efee40a71bec7014dd59f47c006592cd7d54bed65483c0a1ea914ce59796a72d4a389f9aeba24c96c96c7aabf4391ae2d52682dee7
-  data.tar.gz: 11783290520f44642955123ae8b5ae241f6e3d4ec51ad170fb8994a6cee5f79c39de92cd4fd18bf0778f383124164a8b750e398ca6db872a070c421ae1a22132
+  metadata.gz: ef8390ef3ef1a8a80839213405f86e6addde5d6de4de202ed4f7432cb13c9ea368511066eb04915283294df93decec26aec6df57c2579629d13ef0afe3aed568
+  data.tar.gz: 74a462a70c505291c1868c99a2c1015fc1ac25a249eaac582823c9c8c4bf2d96c813eaf4cd4f561cfb40593e06cbd8f26604e4d9f46c8317e2b2138b27e3ed69

data/.travis.yml

@@ -4,13 +4,13 @@ sudo: false
 
 rvm:
 - ruby-1.9.2
-- ruby-1.9.3
-- ruby-2.0.0
-- ruby-2.1.7
-- ruby-2.2.2
+- 1.9.3
+- 2.0
+- 2.1
+- 2.2.3
 - jruby-19mode
-- jruby-1.7.22
-- jruby-9.0.0.0
+- jruby-1.7.23
+- jruby-9.0.4.0
 - rbx-19mode
 - rbx-2
 
@@ -25,9 +25,9 @@ matrix:
   - os: osx
     rvm: jruby-19mode
   - os: osx
-    rvm: jruby-1.7.22
+    rvm: jruby-1.7.23
   - os: osx
-    rvm: jruby-9.0.0.0
+    rvm: jruby-9.0.4.0
   - os: osx
     rvm: rbx-19mode
   - os: osx
@@ -37,5 +37,8 @@ notifications:
   irc:
     channels:
       - "chat.freenode.net#nokogiri"
-    use_notice: true
+    on_success: change
+    on_failure: always
+    template:
+      - "%{repository} (%{branch}:%{commit} by %{author}): %{message} (%{build_url})"
     skip_join: true

data/CHANGELOG.ja.rdoc

@@ -1,3 +1,21 @@
+=== 1.6.8 / 未リリース
+
+==== セキュリティ
+
+* (MRI) Bundled Libxml2 is upgraded to 2.9.3, which fixes a series of security issues. See https://mail.gnome.org/archives/xml/2015-November/msg00012.html
+
+
+==== バグ修正
+
+* [JRuby] fix load errors when deploying to JRuby/Torquebox (#1114) (Thanks, @atambo!)
+* [JRuby] fix NPE when inspecting nodes returned by NodeSet#drop (#1042) (Thanks, @mkristian!)
+* [JRuby] fix nil attriubte node's namespace in reader (#1327) (Thanks, @codekitchen!)
+* [MRI] fix assertion failure while accessing attribute node's namespace in reader (#843) (Thanks, @2potatocakes!)
+* [MRI] fix issue with GCing namespace nodes returned in an xpath query. (#1155)
+* unescape special characters in CSS queries (#1303) (Thanks, @twalpole!)
+* consistently handle empty documents (#1349)
+
+
 === 1.6.7.1 / 2015年12月16日
 
 This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:

data/CHANGELOG.rdoc

@@ -1,12 +1,19 @@
-=== 1.6.7.2 / 2015-01-20
+=== 1.6.8 / unreleased
 
-This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:
+==== Security Note
 
-  CVE-2015-7499
+* (MRI) Bundled Libxml2 is upgraded to 2.9.3, which fixes a series of security issues. See https://mail.gnome.org/archives/xml/2015-November/msg00012.html
 
-Ubuntu classifies this as "Priority: Low", RedHat classifies this as "Impact: Moderate", and NIST classifies this as "Severity: 5.0 (MEDIUM)".
 
-MITRE record is https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499
+==== Bug Fixes
+
+* [JRuby] fix load errors when deploying to JRuby/Torquebox (#1114) (Thanks, @atambo!)
+* [JRuby] fix NPE when inspecting nodes returned by NodeSet#drop (#1042) (Thanks, @mkristian!)
+* [JRuby] fix nil attriubte node's namespace in reader (#1327) (Thanks, @codekitchen!)
+* [MRI] fix assertion failure while accessing attribute node's namespace in reader (#843) (Thanks, @2potatocakes!)
+* [MRI] fix issue with GCing namespace nodes returned in an xpath query. (#1155)
+* unescape special characters in CSS queries (#1303) (Thanks, @twalpole!)
+* consistently handle empty documents (#1349)
 
 
 === 1.6.7.1 / 2015-12-16
@@ -22,8 +29,6 @@ This version pulls in several upstream patches to the vendored libxml2 and libxs
   CVE-2015-8242
   CVE-2015-8317
 
-These CVEs are all low or medium priority according to Canonical, however NIST NVD gives CVE-2015-5312 a high severity score.
-
 See also http://www.ubuntu.com/usn/usn-2834-1/
 
 

data/CONTRIBUTING.md

@@ -0,0 +1,42 @@
+# Issue and Pull Request Guidlines
+
+Thank you for getting involved in making Nokogiri better!
+
+
+## Code of Conduct
+
+For best results, be nice. Remember that Nokogiri maintainers are
+volunteers, and treat them with respect.
+
+Do not act entitled to service. Do not be rude. Do not use judgmental
+or foul language.
+
+The maintainers reserve the right to delete comments that are rude, or
+that contain foul language. The maintainers reserve the right to
+delete comments that they deem harassing or offensive.
+
+
+## Issues
+
+Please read the
+["Getting Help" tutorial](http://www.nokogiri.org/tutorials/getting_help.html)
+at the [nokogiri.org](http://nokogiri.org) site.
+
+If you're reporting an issue, it must contain:
+
+* Example code that reproduces the **observed** behavior.
+* An explanation of what the **expected** behavior is.
+
+That's it. If you don't provide that information, we'll ask you for
+it, tag the story "needs more information", and then after a time will
+close it if the information isn't provided.
+
+
+## Pull Requests
+
+Pull requests must always contain a test to prevent
+regressions. Preferably, the test should demonstrate the __intent__ of
+the code.
+
+We may ask you for clarification if we don't understand the intent of
+the change.

data/Gemfile

@@ -4,7 +4,7 @@
 
 source "https://rubygems.org/"
 
-gem "mini_portile2", "~>2.0.0.rc2"
+gem "mini_portile2", "~>2.0.0"
 
 gem "rdoc", "~>4.0", :group => [:development, :test]
 gem "hoe-bundler", ">=1.1", :group => [:development, :test]

data/Manifest.txt

@@ -5,6 +5,7 @@
 .travis.yml
 CHANGELOG.ja.rdoc
 CHANGELOG.rdoc
+CONTRIBUTING.md
 C_CODING_STYLE.rdoc
 Gemfile
 LICENSE.txt
@@ -241,7 +242,10 @@ lib/nokogiri/xml/xpath/syntax_error.rb
 lib/nokogiri/xml/xpath_context.rb
 lib/nokogiri/xslt.rb
 lib/nokogiri/xslt/stylesheet.rb
+lib/serializer.jar
+lib/xalan.jar
 lib/xercesImpl.jar
+lib/xml-apis.jar
 lib/xsd/xmlparser/nokogiri.rb
 patches/sort-patches-by-date
 suppressions/README.txt
@@ -256,6 +260,7 @@ test/css/test_tokenizer.rb
 test/css/test_xpath_visitor.rb
 test/decorators/test_slop.rb
 test/files/2ch.html
+test/files/GH_1042.html
 test/files/address_book.rlx
 test/files/address_book.xml
 test/files/atom.xml
@@ -268,6 +273,7 @@ test/files/exslt.xml
 test/files/exslt.xslt
 test/files/foo/foo.xsd
 test/files/metacharset.html
+test/files/namespace_pressure_test.xml
 test/files/noencoding.html
 test/files/po.xml
 test/files/po.xsd

data/README.md

@@ -121,7 +121,7 @@ Nokogiri is a large library, but here is example usage for parsing and examining
   gem, but if you want to use the system versions:
 
   * at install time, set the environment variable
-    `USING_SYSTEM_ALLOCATOR_LIBRARY` or else use the
+    `NOKOGIRI_USE_SYSTEM_LIBRARIES` or else use the
     `--use-system-libraries` argument. (See
     http://nokogiri.org/tutorials/installing_nokogiri.html#using_your_system_libraries
     for specifics.)

data/Rakefile

@@ -129,7 +129,7 @@ HOE = Hoe.spec 'nokogiri' do
   unless java?
     self.extra_deps += [
       # Keep this version in sync with the one in extconf.rb !
-      ["mini_portile2",    "~> 2.0.0.rc2"],
+      ["mini_portile2",    "~> 2.0.0"],
     ]
   end
 

data/bin/nokogiri

@@ -41,9 +41,9 @@ opts = OptionParser.new do |opts|
   opts.define_head "Usage: nokogiri <uri|path> [options]"
   opts.separator ""
   opts.separator "Examples:"
-  opts.separator "  nokogiri http://www.ruby-lang.org/"
+  opts.separator "  nokogiri https://www.ruby-lang.org/"
   opts.separator "  nokogiri ./public/index.html"
-  opts.separator "  curl -s http://nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'"
+  opts.separator "  curl -s http://www.nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'"
   opts.separator ""
   opts.separator "Options:"
 

data/dependencies.yml

@@ -1,4 +1,4 @@
-libxml2: "2.9.2"
+libxml2: "2.9.3"
 libxslt: "1.1.28"
 zlib: "1.2.8"
 libiconv: "1.14"

data/ext/nokogiri/extconf.rb

@@ -381,10 +381,10 @@ when using_system_libraries?
 #endif
   SRC
 
-  try_cpp(<<-SRC) or warn "libxml2 version 2.9.2 or later is highly recommended, but proceeding anyway."
+  try_cpp(<<-SRC) or warn "libxml2 version 2.9.3 or later is highly recommended, but proceeding anyway."
 #include <libxml/xmlversion.h>
 
-#if LIBXML_VERSION < 20902
+#if LIBXML_VERSION < 20903
 #error libxml2 is too old
 #endif
   SRC
@@ -393,7 +393,7 @@ else
 
   # The gem version constraint in the Rakefile is not respected at install time.
   # Keep this version in sync with the one in the Rakefile !
-  gem "mini_portile2", "~> 2.0.0.rc2"
+  gem "mini_portile2", "~> 2.0.0"
   require 'mini_portile2'
   message "Using mini_portile version #{MiniPortile::VERSION}\n"
 

data/ext/nokogiri/nokogiri.c

@@ -28,17 +28,10 @@ int vasprintf (char **strp, const char *fmt, va_list ap)
 }
 #endif
 
-#ifdef USING_SYSTEM_ALLOCATOR_LIBRARY /* Ruby Enterprise Edition with tcmalloc */
-void vasprintf_free (void *p)
-{
-  system_free(p);
-}
-#else
 void vasprintf_free (void *p)
 {
   free(p);
 }
-#endif
 
 #ifdef HAVE_RUBY_UTIL_H
 #include "ruby/util.h"

data/ext/nokogiri/nokogiri.h

@@ -31,12 +31,8 @@ int vasprintf (char **strp, const char *fmt, va_list ap);
 #include <libxslt/extensions.h>
 #include <libxml/c14n.h>
 #include <ruby.h>
-
-#ifdef HAVE_RUBY_ENCODING_H
 #include <ruby/st.h>
-#else
-#include <st.h>
-#endif
+#include <ruby/encoding.h>
 
 #ifndef UNUSED
 # if defined(__GNUC__)
@@ -56,25 +52,12 @@ int vasprintf (char **strp, const char *fmt, va_list ap);
 # endif
 #endif
 
-#ifdef HAVE_RUBY_ENCODING_H
-
-#include <ruby/encoding.h>
-
 #define NOKOGIRI_STR_NEW2(str) \
   NOKOGIRI_STR_NEW(str, strlen((const char *)(str)))
 
 #define NOKOGIRI_STR_NEW(str, len) \
   rb_external_str_new_with_enc((const char *)(str), (long)(len), rb_utf8_encoding())
 
-#else
-
-#define NOKOGIRI_STR_NEW2(str) \
-  rb_str_new2((const char *)(str))
-
-#define NOKOGIRI_STR_NEW(str, len) \
-  rb_str_new((const char *)(str), (long)(len))
-#endif
-
 #define RBSTR_OR_QNIL(_str) \
   (_str ? NOKOGIRI_STR_NEW2(_str) : Qnil)
 
@@ -135,22 +118,6 @@ void nokogiri_root_nsdef(xmlNsPtr, xmlDocPtr);
 
 #endif
 
-#ifndef RSTRING_PTR
-#define RSTRING_PTR(s) (RSTRING(s)->ptr)
-#endif
-
-#ifndef RSTRING_LEN
-#define RSTRING_LEN(s) (RSTRING(s)->len)
-#endif
-
-#ifndef RARRAY_PTR
-#define RARRAY_PTR(a) RARRAY(a)->ptr
-#endif
-
-#ifndef RARRAY_LEN
-#define RARRAY_LEN(a) RARRAY(a)->len
-#endif
-
 #ifndef __builtin_expect
 # if defined(__GNUC__)
 #  define __builtin_expect(expr, c) __builtin_expect((long)(expr), (long)(c))

data/ext/nokogiri/xml_document.c

@@ -322,22 +322,20 @@ static VALUE duplicate_document(int argc, VALUE *argv, VALUE self)
   xmlDocPtr doc, dup;
   VALUE copy;
   VALUE level;
-  VALUE error_list      = rb_ary_new();
+  VALUE error_list;
 
   if(rb_scan_args(argc, argv, "01", &level) == 0)
     level = INT2NUM((long)1);
 
   Data_Get_Struct(self, xmlDoc, doc);
 
-  xmlResetLastError();
-  xmlSetStructuredErrorFunc((void *)error_list, Nokogiri_error_array_pusher);
   dup = xmlCopyDoc(doc, (int)NUM2INT(level));
-  xmlSetStructuredErrorFunc(NULL, NULL);
 
   if(dup == NULL) return Qnil;
 
   dup->type = doc->type;
   copy = Nokogiri_wrap_xml_document(rb_obj_class(self), dup);
+  error_list = rb_iv_get(self, "@errors");
   rb_iv_set(copy, "@errors", error_list);
   return copy ;
 }

data/ext/nokogiri/xml_namespace.c

@@ -2,6 +2,34 @@
 
 VALUE cNokogiriXmlNamespace ;
 
+static void dealloc_namespace(xmlNsPtr ns)
+{
+  /*
+   *
+   * this deallocator is only used for namespace nodes that are part of an xpath
+   * node set.
+   *
+   * see Nokogiri_wrap_xml_namespace() for more details.
+   *
+   */
+  NOKOGIRI_DEBUG_START(ns) ;
+  if (ns->href) {
+    xmlFree((xmlChar *)ns->href);
+  }
+  if (ns->prefix) {
+    xmlFree((xmlChar *)ns->prefix);
+  }
+  xmlFree(ns);
+  NOKOGIRI_DEBUG_END(ns) ;
+}
+
+
+int Nokogiri_namespace_eh(xmlNodePtr node)
+{
+  return (node->type == XML_NAMESPACE_DECL);
+}
+
+
 /*
  * call-seq:
  *  prefix
@@ -34,37 +62,48 @@ static VALUE href(VALUE self)
   return NOKOGIRI_STR_NEW2(ns->href);
 }
 
+static int part_of_an_xpath_node_set_eh(xmlNsPtr node)
+{
+  return (node->next && ! Nokogiri_namespace_eh(node->next));
+}
+
 VALUE Nokogiri_wrap_xml_namespace(xmlDocPtr doc, xmlNsPtr node)
 {
   VALUE ns, document, node_cache;
 
-  assert(doc->_private);
+  assert(doc->type == XML_DOCUMENT_NODE || doc->type == XML_HTML_DOCUMENT_NODE);
 
-  if(node->_private)
-    return (VALUE)node->_private;
+  if (node->_private) return (VALUE)node->_private;
 
-  ns = Data_Wrap_Struct(cNokogiriXmlNamespace, 0, 0, node);
+  if (doc->type == XML_DOCUMENT_FRAG_NODE) doc = doc->doc;
 
-  document = DOC_RUBY_OBJECT(doc);
-
-  node_cache = rb_iv_get(document, "@node_cache");
-  rb_ary_push(node_cache, ns);
+  ns = Data_Wrap_Struct(cNokogiriXmlNamespace, 0, 0, node);
 
-  rb_iv_set(ns, "@document", DOC_RUBY_OBJECT(doc));
+  if (DOC_RUBY_OBJECT_TEST(doc)) {
+    document = DOC_RUBY_OBJECT(doc);
+
+    if (part_of_an_xpath_node_set_eh(node)) {
+      /*
+       *  this is a duplicate returned as part of an xpath query node set, and so
+       *  we need to make sure we manage this memory.
+       *
+       *  see comments in xml_node_set.c for more details.
+       */
+      ns = Data_Wrap_Struct(cNokogiriXmlNamespace, 0, dealloc_namespace, node);
+    } else {
+      ns = Data_Wrap_Struct(cNokogiriXmlNamespace, 0, 0, node);
+      node_cache = rb_iv_get(document, "@node_cache");
+      rb_ary_push(node_cache, ns);
+    }
+
+    rb_iv_set(ns, "@document", document);
+  }
 
   node->_private = (void *)ns;
 
   return ns;
 }
 
-VALUE Nokogiri_wrap_xml_namespace2(VALUE document, xmlNsPtr node)
-{
-  xmlDocPtr doc;
-  Data_Get_Struct(document, xmlDoc, doc) ;
-  return Nokogiri_wrap_xml_namespace(doc, node);
-}
-
-
 void init_xml_namespace()
 {
   VALUE nokogiri  = rb_define_module("Nokogiri");