nokogiri 1.10.2-x64-mingw32 → 1.10.3-x64-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca3ad1183bbdd52d3370b9bf6094f679c7656788700c33e722a2a6de4bded284
-  data.tar.gz: f1081c3d2fc7efe95dcaebb17aec1469142bbbefc16bf034e2c0b0c27364dc26
+  metadata.gz: c86a65945859efc8bb1073c8e131ff6392461c1d91b68c3c26bec128eb80aafe
+  data.tar.gz: 91c2262335d7d6de95c1a758bd5d6042b27cf61990d007174128d61ee3593f52
 SHA512:
-  metadata.gz: 86a844723c2d44fed4534c648221d532955cb5cf7cd077a528737c17aa9f55c345644a61f63a6ef89dcc75d215373daefb24bcbcb5685f13106f3f88c1181374
-  data.tar.gz: b9088a49b916841fa5c246b6a7dbf28fbb200e0b926d069caa9ef4acdd76fa8f077f320be7c102132ee72086cdaa27f5e2cd1d3bdffc48041e6f8edf4921d922
+  metadata.gz: 3a3e81188c260f6191b71cb33fb4ed08290c22b91f3080468ef4ab53e8a4eca388022b285de7191ab0903007b220680b189e8c94cb67b2dd7821b7dc5f08b46e
+  data.tar.gz: 993fdaae7b8da672de6a0db897f6972e48c8713fae3a26916b350b702a2a7c37fbe2d8457a8eda2a3f048af9f38c9124dc817d9ddf0ce39883344d3c4e3fd3a8

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = "1.10.2"
+  VERSION = "1.10.3"
 
   class VersionInfo # :nodoc:
     def jruby?
@@ -8,7 +8,7 @@ module Nokogiri
     end
 
     def engine
-      defined?(RUBY_ENGINE) ? RUBY_ENGINE : 'mri'
+      defined?(RUBY_ENGINE) ? RUBY_ENGINE : "mri"
     end
 
     def loaded_parser_version
@@ -27,7 +27,7 @@ module Nokogiri
     end
 
     def libxml2_using_system?
-      ! libxml2_using_packaged?
+      !libxml2_using_packaged?
     end
 
     def libxml2_using_packaged?
@@ -46,33 +46,33 @@ module Nokogiri
 
     def to_hash
       hash_info = {}
-      hash_info['warnings']              = []
-      hash_info['nokogiri']              = Nokogiri::VERSION
-      hash_info['ruby']                  = {}
-      hash_info['ruby']['version']       = ::RUBY_VERSION
-      hash_info['ruby']['platform']      = ::RUBY_PLATFORM
-      hash_info['ruby']['description']   = ::RUBY_DESCRIPTION
-      hash_info['ruby']['engine']        = engine
-      hash_info['ruby']['jruby']         = jruby? if jruby?
+      hash_info["warnings"] = []
+      hash_info["nokogiri"] = Nokogiri::VERSION
+      hash_info["ruby"] = {}
+      hash_info["ruby"]["version"] = ::RUBY_VERSION
+      hash_info["ruby"]["platform"] = ::RUBY_PLATFORM
+      hash_info["ruby"]["description"] = ::RUBY_DESCRIPTION
+      hash_info["ruby"]["engine"] = engine
+      hash_info["ruby"]["jruby"] = jruby? if jruby?
 
       if libxml2?
-        hash_info['libxml']              = {}
-        hash_info['libxml']['binding']   = 'extension'
+        hash_info["libxml"] = {}
+        hash_info["libxml"]["binding"] = "extension"
         if libxml2_using_packaged?
-          hash_info['libxml']['source']  = "packaged"
-          hash_info['libxml']['libxml2_path'] = NOKOGIRI_LIBXML2_PATH
-          hash_info['libxml']['libxslt_path'] = NOKOGIRI_LIBXSLT_PATH
-          hash_info['libxml']['libxml2_patches'] = NOKOGIRI_LIBXML2_PATCHES
-          hash_info['libxml']['libxslt_patches'] = NOKOGIRI_LIBXSLT_PATCHES
+          hash_info["libxml"]["source"] = "packaged"
+          hash_info["libxml"]["libxml2_path"] = NOKOGIRI_LIBXML2_PATH
+          hash_info["libxml"]["libxslt_path"] = NOKOGIRI_LIBXSLT_PATH
+          hash_info["libxml"]["libxml2_patches"] = NOKOGIRI_LIBXML2_PATCHES
+          hash_info["libxml"]["libxslt_patches"] = NOKOGIRI_LIBXSLT_PATCHES
         else
-          hash_info['libxml']['source']  = "system"
+          hash_info["libxml"]["source"] = "system"
         end
-        hash_info['libxml']['compiled']  = compiled_parser_version
-        hash_info['libxml']['loaded']    = loaded_parser_version
-        hash_info['warnings']            = warnings
+        hash_info["libxml"]["compiled"] = compiled_parser_version
+        hash_info["libxml"]["loaded"] = loaded_parser_version
+        hash_info["warnings"] = warnings
       elsif jruby?
-        hash_info['xerces']   = Nokogiri::XERCES_VERSION
-        hash_info['nekohtml'] = Nokogiri::NEKO_VERSION
+        hash_info["xerces"] = Nokogiri::XERCES_VERSION
+        hash_info["nekohtml"] = Nokogiri::NEKO_VERSION
       end
 
       hash_info
@@ -80,10 +80,10 @@ module Nokogiri
 
     def to_markdown
       begin
-        require 'psych'
+        require "psych"
       rescue LoadError
       end
-      require 'yaml'
+      require "yaml"
       "# Nokogiri (#{Nokogiri::VERSION})\n" +
       YAML.dump(to_hash).each_line.map { |line| "    #{line}" }.join
     end

data/patches/libxslt/0001-Fix-security-framework-bypass.patch

@@ -0,0 +1,120 @@
+From e03553605b45c88f0b4b2980adfbbb8f6fca2fd6 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sun, 24 Mar 2019 09:51:39 +0100
+Subject: [PATCH] Fix security framework bypass
+
+xsltCheckRead and xsltCheckWrite return -1 in case of error but callers
+don't check for this condition and allow access. With a specially
+crafted URL, xsltCheckRead could be tricked into returning an error
+because of a supposedly invalid URL that would still be loaded
+succesfully later on.
+
+Fixes #12.
+
+Thanks to Felix Wilhelm for the report.
+---
+ libxslt/documents.c | 18 ++++++++++--------
+ libxslt/imports.c   |  9 +++++----
+ libxslt/transform.c |  9 +++++----
+ libxslt/xslt.c      |  9 +++++----
+ 4 files changed, 25 insertions(+), 20 deletions(-)
+
+diff --git a/libxslt/documents.c b/libxslt/documents.c
+index 3f3a731..4aad11b 100644
+--- a/libxslt/documents.c
++++ b/libxslt/documents.c
+@@ -296,10 +296,11 @@ xsltLoadDocument(xsltTransformContextPtr ctxt, const xmlChar *URI) {
+ 	int res;
+ 
+ 	res = xsltCheckRead(ctxt->sec, ctxt, URI);
+-	if (res == 0) {
+-	    xsltTransformError(ctxt, NULL, NULL,
+-		 "xsltLoadDocument: read rights for %s denied\n",
+-			     URI);
++	if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(ctxt, NULL, NULL,
++                     "xsltLoadDocument: read rights for %s denied\n",
++                                 URI);
+ 	    return(NULL);
+ 	}
+     }
+@@ -372,10 +373,11 @@ xsltLoadStyleDocument(xsltStylesheetPtr style, const xmlChar *URI) {
+ 	int res;
+ 
+ 	res = xsltCheckRead(sec, NULL, URI);
+-	if (res == 0) {
+-	    xsltTransformError(NULL, NULL, NULL,
+-		 "xsltLoadStyleDocument: read rights for %s denied\n",
+-			     URI);
++	if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsltLoadStyleDocument: read rights for %s denied\n",
++                                 URI);
+ 	    return(NULL);
+ 	}
+     }
+diff --git a/libxslt/imports.c b/libxslt/imports.c
+index 874870c..3783b24 100644
+--- a/libxslt/imports.c
++++ b/libxslt/imports.c
+@@ -130,10 +130,11 @@ xsltParseStylesheetImport(xsltStylesheetPtr style, xmlNodePtr cur) {
+ 	int secres;
+ 
+ 	secres = xsltCheckRead(sec, NULL, URI);
+-	if (secres == 0) {
+-	    xsltTransformError(NULL, NULL, NULL,
+-		 "xsl:import: read rights for %s denied\n",
+-			     URI);
++	if (secres <= 0) {
++            if (secres == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsl:import: read rights for %s denied\n",
++                                 URI);
+ 	    goto error;
+ 	}
+     }
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 1379391..0636dbd 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -3493,10 +3493,11 @@ xsltDocumentElem(xsltTransformContextPtr ctxt, xmlNodePtr node,
+      */
+     if (ctxt->sec != NULL) {
+ 	ret = xsltCheckWrite(ctxt->sec, ctxt, filename);
+-	if (ret == 0) {
+-	    xsltTransformError(ctxt, NULL, inst,
+-		 "xsltDocumentElem: write rights for %s denied\n",
+-			     filename);
++	if (ret <= 0) {
++            if (ret == 0)
++                xsltTransformError(ctxt, NULL, inst,
++                     "xsltDocumentElem: write rights for %s denied\n",
++                                 filename);
+ 	    xmlFree(URL);
+ 	    xmlFree(filename);
+ 	    return;
+diff --git a/libxslt/xslt.c b/libxslt/xslt.c
+index 780a5ad..a234eb7 100644
+--- a/libxslt/xslt.c
++++ b/libxslt/xslt.c
+@@ -6763,10 +6763,11 @@ xsltParseStylesheetFile(const xmlChar* filename) {
+ 	int res;
+ 
+ 	res = xsltCheckRead(sec, NULL, filename);
+-	if (res == 0) {
+-	    xsltTransformError(NULL, NULL, NULL,
+-		 "xsltParseStylesheetFile: read rights for %s denied\n",
+-			     filename);
++	if (res <= 0) {
++            if (res == 0)
++                xsltTransformError(NULL, NULL, NULL,
++                     "xsltParseStylesheetFile: read rights for %s denied\n",
++                                 filename);
+ 	    return(NULL);
+ 	}
+     }
+-- 
+2.17.1
+

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.10.2
+  version: 1.10.3
 platform: x64-mingw32
 authors:
 - Aaron Patterson
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-25 00:00:00.000000000 Z
+date: 2019-04-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile2
@@ -431,6 +431,7 @@ files:
 - patches/libxml2/0001-Revert-Do-not-URI-escape-in-server-side-includes.patch
 - patches/libxml2/0002-Remove-script-macro-support.patch
 - patches/libxml2/0003-Update-entities-to-remove-handling-of-ssi.patch
+- patches/libxslt/0001-Fix-security-framework-bypass.patch
 homepage: 
 licenses:
 - MIT