nokogiri 1.10.7 → 1.10.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1715e5bd91f81db263be5e5a4b15e11054735c3d969b469240d42f06acf403db
-  data.tar.gz: fdaaafc9da2060347de3bf9711e440e722fd6feca418d215d234197cde8d7083
+  metadata.gz: e9fbdbd925466e95e61566b1a8764889f23c596c3bda5ea28feed0acf85c6b99
+  data.tar.gz: 2060b7113b6bcfb7176b99d2d14b2e2dbdc19e198fd1185728d04272a13340cc
 SHA512:
-  metadata.gz: 0b02f5e935859c7ebe86769cccae492a302f72d449b6287202a4d191dd9d0fd0ef25adb5cc2eaec57c7d5cff1607656d80af030fa8ec71c5cae2534b3eef18ba
-  data.tar.gz: 1b24d7bf3880064718425be8cf7483f8bb398c12a271312c10b73dec2d15e127e924101986626e4f93c6cb3193e8131f3ded120955091eae5cf8a74f0aa11dcc
+  metadata.gz: e2a54877f2be89ec80f5cde2cbccdc92afb8f5dbd9f2ead7663d06094945d0a38652b4d57d22c9697801eac893f4e9e40899e23b8673cbb53e8c85e644ac4529
+  data.tar.gz: e1dc94dcf380e5884c2a941a7b49f1c70e8b93a371aabc20fbdfa460d4f585c7a0ad12bc2216c648bd440b01cc597a72f4a30c5e98c0425daa0cf890047833a2

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = "1.10.7"
+  VERSION = "1.10.8"
 
   class VersionInfo # :nodoc:
     def jruby?

data/patches/libxml2/0005-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch

@@ -0,0 +1,32 @@
+From 0e1a49c8907645d2e155f0d89d4d9895ac5112b5 Mon Sep 17 00:00:00 2001
+From: Zhipeng Xie <xiezhipeng1@huawei.com>
+Date: Thu, 12 Dec 2019 17:30:55 +0800
+Subject: [PATCH] Fix infinite loop in xmlStringLenDecodeEntities
+
+When ctxt->instate == XML_PARSER_EOF,xmlParseStringEntityRef
+return NULL which cause a infinite loop in xmlStringLenDecodeEntities
+
+Found with libFuzzer.
+
+Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
+---
+ parser.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index d1c3196..a34bb6c 100644
+--- a/parser.c
++++ b/parser.c
+@@ -2646,7 +2646,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
+     else
+         c = 0;
+     while ((c != 0) && (c != end) && /* non input consuming loop */
+-	   (c != end2) && (c != end3)) {
++           (c != end2) && (c != end3) &&
++           (ctxt->instate != XML_PARSER_EOF)) {
+ 
+ 	if (c == 0) break;
+         if ((c == '&') && (str[1] == '#')) {
+-- 
+2.17.1
+

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.10.7
+  version: 1.10.8
 platform: ruby
 authors:
 - Aaron Patterson
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-04 00:00:00.000000000 Z
+date: 2020-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile2
@@ -148,14 +148,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.3
+        version: 1.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.3
+        version: 1.1.0
 - !ruby/object:Gem::Dependency
   name: rake-compiler-dock
   requirement: !ruby/object:Gem::Requirement
@@ -238,14 +238,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.20'
+        version: '3.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.20'
+        version: '3.22'
 description: |-
   Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser.  Among
   Nokogiri's many features is the ability to search documents via XPath
@@ -443,6 +443,7 @@ files:
 - patches/libxml2/0002-Remove-script-macro-support.patch
 - patches/libxml2/0003-Update-entities-to-remove-handling-of-ssi.patch
 - patches/libxml2/0004-libxml2.la-is-in-top_builddir.patch
+- patches/libxml2/0005-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
 - ports/archives/libxml2-2.9.10.tar.gz
 - ports/archives/libxslt-1.1.34.tar.gz
 homepage: https://nokogiri.org
@@ -471,7 +472,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser