nokogiri 1.8.2 → 1.8.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8eda887f0620302cc831ef126a36321b38a294b6
-  data.tar.gz: c16a8f4170ccb1bb77dca63b595371a806eb49de
+  metadata.gz: e9cb90366d939c0faa58cf42e74ec4948e3ba422
+  data.tar.gz: 970ab46f73afddcca4a8ab4651723214f80b6e7b
 SHA512:
-  metadata.gz: 742e024c0c7d28ae1be933a52f42abeda71eca9b971bd314885c95559e531d8fbb009917e272f418ae6bb5decfe70eabcc9031f83adb1e360e27f18d7d97003f
-  data.tar.gz: 44cf0e20486485ea7e586ad87100f8f4df7dd4afbe46f4df8217c513e92bde898ed427403388c7931a8da1e7390f4786c1189154ca881bae1f1b2544706e6fff
+  metadata.gz: 527d7db935032c25b260a131d01bb3b2634ecd6a4edd144b57aa1d7185f54ca27deb7aa3aaccf077f4b291552307b9ec235e1beac1fd5909c365ac6389bb13d4
+  data.tar.gz: 28a130a618bd4bc2ce69cf9c050017d7e60ef922916624a5cdf588b4a962119381bb73327f1c65c52629b47027a5f481f7f1378414e3f18cdb7f65f37a8124d5

data/.travis.yml

@@ -18,15 +18,15 @@ matrix:
   - os: osx
     rvm: 2.2.5
   - os: linux
-    rvm: 2.3.1
+    rvm: 2.3.5
   - os: osx
-    rvm: 2.3.1
+    rvm: 2.3.5
   - os: linux
-    rvm: 2.4.0
+    rvm: 2.4.2
     env:
       - RUBYOPT="--enable-frozen-string-literal --debug=frozen-string-literal"
   - os: osx
-    rvm: 2.4.0
+    rvm: 2.4.2
     env:
       - RUBYOPT="--enable-frozen-string-literal --debug=frozen-string-literal"
   - os: linux
@@ -40,22 +40,22 @@ matrix:
   - os: linux
     rvm: jruby-1.7
   - os: linux
-    rvm: jruby-9.1.5.0
+    rvm: jruby-9.1.15.0
   - os: linux
     rvm: rbx-3
   allow_failures:
   - rvm: ruby-head
   fast_finish: true
 
-notifications:
-  irc:
-    channels:
-      - "chat.freenode.net#nokogiri"
-    on_success: always
-    on_failure: always
-    template:
-      - "%{repository} (%{branch}:%{commit} by %{author}): %{message} (%{build_url})"
-    skip_join: true
+# notifications:
+#   irc:
+#     channels:
+#       - "chat.freenode.net#nokogiri"
+#     on_success: always
+#     on_failure: always
+#     template:
+#       - "%{repository} (%{branch}:%{commit} by %{author}): %{message} (%{build_url})"
+#     skip_join: true
 
 addons:
   apt:

data/CHANGELOG.md

@@ -1,3 +1,45 @@
+# 1.8.3 / 2018-06-16
+
+## Security Notes
+
+[MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here:
+
+> https://github.com/GNOME/libxml2/commit/960f0e2
+
+and more information is available about this commit and its impact here:
+
+> https://github.com/flavorjones/loofah/issues/144
+
+This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities.
+
+If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here:
+
+> https://bugzilla.gnome.org/show_bug.cgi?id=769760
+
+
+## Dependencies
+
+* [MRI] libxml2 is updated from 2.9.7 to 2.9.8
+
+
+## Features
+
+* Node#classes, #add_class, #append_class, and #remove_class are added.
+* NodeSet#append_class is added.
+* NodeSet#remove_attribute is a new alias for NodeSet#remove_attr.
+* NodeSet#each now returns an Enumerator when no block is passed (Thanks, @park53kr!)
+* [JRuby] General improvements in JRuby implementation (Thanks, @kares!)
+
+
+## Bug fixes
+
+* CSS attribute selectors now gracefully handle queries using integers. [#711]
+* Handle ASCII-8BIT encoding on fragment input [#553]
+* Handle non-string return values within `Reader` [#898]
+* [JRuby] Allow Node#replace to insert Comment and CDATA nodes. [#1666]
+* [JRuby] Stability and speed improvements to `Node`, `Sax::PushParser`, and the JRuby implementation [#1708, #1710, #1501]
+
+
 # 1.8.2 / 2018-01-29
 
 ## Security Notes
@@ -8,7 +50,7 @@
 ## Dependencies
 
 * [MRI] libxml2 is updated from 2.9.5 to 2.9.7
-* [MRI] libxml2 is updated from 1.1.30 to 1.1.32
+* [MRI] libxslt is updated from 1.1.30 to 1.1.32
 
 
 ## Features

data/LICENSE.md

@@ -1,6 +1,6 @@
 (The MIT License)
 
-Copyright (c) 2008 - 2017:
+Copyright (c) 2008 - 2018:
 
 * [Aaron Patterson](http://tenderlovemaking.com)
 * [Mike Dalessio](http://mike.daless.io)
@@ -10,6 +10,7 @@ Copyright (c) 2008 - 2017:
 * [Yoko Harada](http://yokolet.blogspot.com)
 * [Akinori MUSHA](https://akinori.org)
 * [John Shahid](https://github.com/jvshahid)
+* [Lars Kanis](https://github.com/larskanis)
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/Manifest.txt

@@ -14,6 +14,7 @@ Manifest.txt
 README.md
 ROADMAP.md
 Rakefile
+SECURITY.md
 STANDARD_RESPONSES.md
 Y_U_NO_GEMSPEC.md
 appveyor.yml
@@ -249,6 +250,7 @@ lib/xalan.jar
 lib/xercesImpl.jar
 lib/xml-apis.jar
 lib/xsd/xmlparser/nokogiri.rb
+patches/libxml2/0001-Revert-Do-not-URI-escape-in-server-side-includes.patch
 patches/sort-patches-by-date
 suppressions/README.txt
 suppressions/nokogiri_ruby-2.supp
@@ -300,6 +302,7 @@ test/html/sax/test_parser.rb
 test/html/sax/test_parser_context.rb
 test/html/sax/test_parser_text.rb
 test/html/sax/test_push_parser.rb
+test/html/test_attributes.rb
 test/html/test_builder.rb
 test/html/test_document.rb
 test/html/test_document_encoding.rb

data/README.md

@@ -1,30 +1,24 @@
 # Nokogiri
 
-* http://nokogiri.org
-* Installation: http://nokogiri.org/tutorials/installing_nokogiri.html
-* Tutorials:    http://nokogiri.org
-* README:       https://github.com/sparklemotion/nokogiri
-* Mailing List: https://groups.google.com/group/nokogiri-talk
-* Bug Reports:  https://github.com/sparklemotion/nokogiri/issues
-
-
-## Status
-
-|System|Status|
-|--|--|
-| Concourse | [![Concourse CI](https://ci.nokogiri.org/api/v1/teams/nokogiri-core/pipelines/nokogiri/jobs/ruby-2.4-system/badge)](https://ci.nokogiri.org/teams/nokogiri-core/pipelines/nokogiri?groups=master) |
-| Travis | [![Travis Build Status](https://travis-ci.org/sparklemotion/nokogiri.svg?branch=master)](https://travis-ci.org/sparklemotion/nokogiri) |
-| Appveyor | [![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/github/sparklemotion/nokogiri?branch=master&svg=true)](https://ci.appveyor.com/project/flavorjones/nokogiri?branch=master) |
-| Code Climate | [![Code Climate](https://codeclimate.com/github/sparklemotion/nokogiri.svg)](https://codeclimate.com/github/sparklemotion/nokogiri) |
-| Version Eye | [![Version Eye](https://www.versioneye.com/ruby/nokogiri/badge.png)](https://www.versioneye.com/ruby/nokogiri) |
-
-
 ## Description
 
 Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser.  Among
 Nokogiri's many features is the ability to search documents via XPath
 or CSS3 selectors.
 
+* http://nokogiri.org
+* [Installation Help](http://nokogiri.org/tutorials/installing_nokogiri.html)
+* [Tutorials](http://nokogiri.org)
+* [GitHub](https://github.com/sparklemotion/nokogiri)
+* [Mailing List](https://groups.google.com/group/nokogiri-talk)
+* [Bug Reports](https://github.com/sparklemotion/nokogiri/issues)
+* [Chat/Gitter](https://gitter.im/sparklemotion/nokogiri)
+
+[![Concourse CI](https://ci.nokogiri.org/api/v1/teams/nokogiri-core/pipelines/nokogiri/jobs/ruby-2.4-system/badge)](https://ci.nokogiri.org/teams/nokogiri-core/pipelines/nokogiri?groups=master)
+[![Code Climate](https://codeclimate.com/github/sparklemotion/nokogiri.svg)](https://codeclimate.com/github/sparklemotion/nokogiri)
+[![Version Eye](https://www.versioneye.com/ruby/nokogiri/badge.png)](https://www.versioneye.com/ruby/nokogiri)
+[![Join the chat at https://gitter.im/sparklemotion/nokogiri](https://badges.gitter.im/sparklemotion/nokogiri.svg)](https://gitter.im/sparklemotion/nokogiri?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
 
 ## Features
 
@@ -81,6 +75,11 @@ There are open-source tutorials (to which we invite contributions!) here: http:/
 * The IRC channel is #nokogiri on freenode.
 
 
+## Security and Vulnerability Reporting
+
+See [`SECURITY.md`](SECURITY.md)
+
+
 ## Synopsis
 
 Nokogiri is a large library, but here is example usage for parsing and examining a document:
@@ -158,7 +157,7 @@ best bet is to explicitly set the encoding.  Here is an example of
 explicitly setting the encoding to EUC-JP on the parser:
 
 ```ruby
-  doc = Nokogiri.XML('<foo><bar /><foo>', nil, 'EUC-JP')
+  doc = Nokogiri.XML('<foo><bar /></foo>', nil, 'EUC-JP')
 ```
 
 ## Development
@@ -170,4 +169,4 @@ explicitly setting the encoding to EUC-JP on the parser:
 
 ## License
 
-MIT. See the `LICENSE.md` file.
+MIT. See [`LICENSE.md`](LICENSE.md).

data/Rakefile

@@ -107,6 +107,8 @@ HOE = Hoe.spec 'nokogiri' do
   developer 'Yoko Harada',     'yokolet@gmail.com'
   developer 'Tim Elliott',     'tle@holymonkey.com'
   developer 'Akinori MUSHA',   'knu@idaemons.org'
+  developer 'John Shahid',     'jvshahid@gmail.com'
+  developer 'Lars Kanis',      'lars@greiz-reinsdorf.de'
 
   license "MIT"
 
@@ -292,14 +294,6 @@ task :java_debug do
   ENV['JAVA_OPTS'] = '-Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=y' if ENV['JAVA_DEBUG']
 end
 
-if java?
-  task :test_19 => :test
-  task :test_20 do
-    ENV['JRUBY_OPTS'] = "--2.0"
-    Rake::Task["test"].invoke
-  end
-end
-
 Rake::Task[:test].prerequisites << :compile
 Rake::Task[:test].prerequisites << :java_debug
 Rake::Task[:test].prerequisites << :check_extra_deps unless java?

data/SECURITY.md

@@ -0,0 +1,19 @@
+# Security and Vulnerability Reporting
+
+The Nokogiri Core Contributors take security very seriously and investigate all reported vulnerabilities.
+
+If you would like to report a vulnerablity or have a security concern regarding Nokogiri or how Nokogiri is using any of its underlying platform-specific libraries (such as libxml2 or xerces), please [report it via HackerOne](https://hackerone.com/nokogiri/reports/new).
+
+Your report will be acknowledged within 24 hours, and you'll receive a more detailed response within 72 hours indicating next steps in handling your report.
+
+If you have not received a reply to your submission within 48 hours, there are a few steps you can take:
+
+* Contact the current security coordinator (Mike Dalessio <mike.dalessio@gmail.com>)
+* Contact the core contributor mailing list (nokogiri-core@googlegroups.com)
+* Join the [nokogiri-talk group](https://groups.google.com/d/forum/nokogiri-talk)
+
+Please note, the nokogiri-talk list is a public area. When escalating in that venue, please do not discuss your issue. Simply say that you're trying to get a hold of someone from the core team.
+
+The information you share with the Nokogiri Core Contributors as part of this process will be kept confidential within the team, unless or until we need to share information upstream with our dependent libraries' core teams, at which point we will notify you.
+
+If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure.

data/build_all

@@ -37,8 +37,8 @@ cp -v pkg/nokogiri*.gem gems
 bundle exec rake clean clobber
 bundle exec rake generate
 
-rvm jruby-1.7.19
+rvm jruby
 gem install bundler --conservative
 bundle install --quiet --local || bundle install
-bundle exec rake gem
+bundle exec ruby -S rake gem
 cp -v pkg/nokogiri*java.gem gems

data/dependencies.yml

@@ -1,10 +1,10 @@
 libxml2:
-  version: "2.9.7"
-  sha256: "f63c5e7d30362ed28b38bfa1ac6313f9a80230720b7fb6c80575eeab3ff5900c"
+  version: "2.9.8"
+  sha256: "0b74e51595654f958148759cfef0993114ddccccbb6f31aee018f3558e8e2732"
   # manually verified checksum:
   #
-  #   $ gpg --verify libxml2-2.9.7.tar.gz.asc libxml2-2.9.7.tar.gz
-  #   gpg: Signature made Thu 02 Nov 2017 04:17:54 PM EDT using RSA key ID 596BEA5D
+  #   $ gpg --verify libxml2-2.9.8.tar.gz.asc ./ports/archives/libxml2-2.9.8.tar.gz
+  #   gpg: Signature made Mon 05 Mar 2018 11:07:45 AM EST using RSA key ID 596BEA5D
   #   gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>"
   #   gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>"
   #   gpg: WARNING: This key is not certified with a trusted signature!
@@ -15,13 +15,13 @@ libxml2:
   # using this pgp signature:
   #   -----BEGIN PGP SIGNATURE-----
   #
-  #   iQEcBAABAgAGBQJZ+31yAAoJEBVYiyZZa+pd+MMH/RTsPCo8CegAHsSUlNCae2Ay
-  #   HpM6J7sNWs0b2xwaYRtwhewJ5z/rsCcM5nn7MeGiU8dX7W5MKF69uGXUywufRxzO
-  #   GFoQSxO0a1z5mtGu7jC/W6DTYHFBeOJcEfMa3zUZjZ0RXqrENRhX55okse4pJPmG
-  #   dWQphbu9G3qoCuWD7QpyI7Mjhjemmyi4Ai/4vJPO8WtB7VDfdtpuZFVCRLG2cp0X
-  #   90SZde+0oWJcN8oIG3FaTd7O4OuJPAceqNhTvF90dLvqSqRBd0RqZNnjYNYZ6uRy
-  #   FQSlQBVCxdLY0AI7Yooq79TJD+0vcqiQNwQwH7L+hBWgvPos4DKN1M9LaJc/RTk=
-  #   =5Qzo
+  #   iQEcBAABAgAGBQJanWtRAAoJEBVYiyZZa+pdV7oIAJWdFahwt+reN/Zt2RPmjjcr
+  #   eSsY7UV1RXjScnNjTzJT1h2hJ7SnUjCkqjR6VdtKDUIzpuX+S2U83joafJH6mxUb
+  #   yw2nO4RfjYTPxpz5JkvqT7jmgEIaD81BuwcMehqpMpIfiKa2NgO1DSfZxgs8a9E2
+  #   +ehc/kZWuI5gmNGrd84EEWUqpYW/Xx7jy02osioJuU5IMPjzZKNR3maXp9oAKeBc
+  #   S2QNa1ID/pUk3K3M/5nlwNgAtQ7lxQrqhrSma2dsKt/IpL6VXomxuD4Bh1r2MZhX
+  #   uZ456X/xJN8UmPewLZWGBU1MK9wqu3Zx5Qwz64H6UdlYIzXZ2jXj2YWZa6xkxPA=
+  #   =69xn
   #   -----END PGP SIGNATURE-----
   #
 

data/ext/nokogiri/extconf.rb

@@ -434,7 +434,7 @@ end
 
 if RbConfig::MAKEFILE_CONFIG['CC'] =~ /gcc/
   $CFLAGS << " -O3" unless $CFLAGS[/-O\d/]
-  $CFLAGS << " -Wall -Wcast-qual -Wwrite-strings -Wconversion -Wmissing-noreturn -Winline"
+  $CFLAGS << " -Wall -Wcast-qual -Wwrite-strings -Wextra -Wmissing-noreturn -Winline"
 end
 
 case

data/ext/nokogiri/html_element_description.c

@@ -8,7 +8,7 @@
  */
 static VALUE required_attributes(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   VALUE list;
   int i;
 
@@ -33,7 +33,7 @@ static VALUE required_attributes(VALUE self)
  */
 static VALUE deprecated_attributes(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   VALUE list;
   int i;
 
@@ -58,7 +58,7 @@ static VALUE deprecated_attributes(VALUE self)
  */
 static VALUE optional_attributes(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   VALUE list;
   int i;
 
@@ -83,7 +83,7 @@ static VALUE optional_attributes(VALUE self)
  */
 static VALUE default_sub_element(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if (description->defaultsubelt)
@@ -100,7 +100,7 @@ static VALUE default_sub_element(VALUE self)
  */
 static VALUE sub_elements(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   VALUE list;
   int i;
 
@@ -125,7 +125,7 @@ static VALUE sub_elements(VALUE self)
  */
 static VALUE description(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   return NOKOGIRI_STR_NEW2(description->desc);
@@ -139,7 +139,7 @@ static VALUE description(VALUE self)
  */
 static VALUE inline_eh(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(description->isinline) return Qtrue;
@@ -154,7 +154,7 @@ static VALUE inline_eh(VALUE self)
  */
 static VALUE deprecated_eh(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(description->depr) return Qtrue;
@@ -169,7 +169,7 @@ static VALUE deprecated_eh(VALUE self)
  */
 static VALUE empty_eh(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(description->empty) return Qtrue;
@@ -184,7 +184,7 @@ static VALUE empty_eh(VALUE self)
  */
 static VALUE save_end_tag_eh(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(description->saveEndTag) return Qtrue;
@@ -199,7 +199,7 @@ static VALUE save_end_tag_eh(VALUE self)
  */
 static VALUE implied_end_tag_eh(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(description->endTag) return Qtrue;
@@ -214,7 +214,7 @@ static VALUE implied_end_tag_eh(VALUE self)
  */
 static VALUE implied_start_tag_eh(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(description->startTag) return Qtrue;
@@ -229,7 +229,7 @@ static VALUE implied_start_tag_eh(VALUE self)
  */
 static VALUE name(VALUE self)
 {
-  htmlElemDesc * description;
+  const htmlElemDesc * description;
   Data_Get_Struct(self, htmlElemDesc, description);
 
   if(NULL == description->name) return Qnil;
@@ -249,7 +249,7 @@ static VALUE get_description(VALUE klass, VALUE tag_name)
   );
 
   if(NULL == description) return Qnil;
-  return Data_Wrap_Struct(klass, 0, 0, (void *)description);
+  return Data_Wrap_Struct(klass, 0, 0, (void *)(uintptr_t)description);
 }
 
 VALUE cNokogiriHtmlElementDescription ;