openehr 2.3.1 → 2.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d2c2f002014051bc668449dbd7a7c79c2a75d4664d702670e80a9307b43ffb4
-  data.tar.gz: 374eccbd5be4cb9b76de4563a4648e5e2f346828a1abbe3988c6280de4278ecb
+  metadata.gz: a3d85dcafa7ccea7c1ae4a7cd794297b9b7c4b6a6126bae494fb5a6d9538fffc
+  data.tar.gz: 34bfec35b2de56cc2c97a02d049f6233b011d3e93908db2b5065f5fc1ede068e
 SHA512:
-  metadata.gz: 7f5d3125c74f02accf2a6149ddfd7cfb5d79040184b1668de32a5850bf35a1464c2d448d140e865aa9e132adf3d8c93aca0d857a10c2ce96f54af2180a973c17
-  data.tar.gz: f0707a9dc5ed67e5ba4277177c1b5b3fe8e053251ca04f06f0abf326038d430a669dd5988de8793d4486dcae087f44d11f139c23b89df2f9409ee6195c9738d4
+  metadata.gz: 9793f50126a31f5d84a21304cd55ecb1fcc3a65569ba9eb1c3c73de1e15ea991a7cc245cec6c37dde71ed8fa861df809d919e02e13baad328ee75d2f0b44a5c5
+  data.tar.gz: a79ea4ee8a7981000548c16405561f255f6c08b5a0fa413f7cc9301fa165894f1401ec0bcd9c7669f0f0018e3178cf479643212ae3feaa31c20225ef249cc35e

data/lib/openehr/parser/opt_parser.rb

@@ -40,7 +40,9 @@ module OpenEHR
       OCCURRENCE_PATH = '/occurrences'
 
       def parse
-        @opt = Nokogiri::XML::Document.parse(File.open(@filename))
+        @opt = File.open(@filename) do |file|
+          Nokogiri::XML::Document.parse(file, options: SAFE_PARSE_OPTIONS)
+        end
         @opt.remove_namespaces!
 
         uid = build_uid

data/lib/openehr/parser/xml_archetype_parser.rb

@@ -30,7 +30,9 @@ module OpenEHR
 
       def doc
         @doc ||= begin
-          parsed = Nokogiri::XML::Document.parse(File.open(@filename, 'rb:bom|utf-8'))
+          parsed = File.open(@filename, 'rb:bom|utf-8') do |file|
+            Nokogiri::XML::Document.parse(file, options: SAFE_PARSE_OPTIONS)
+          end
           parsed.remove_namespaces!
           parsed
         end

data/lib/openehr/parser.rb

@@ -1,6 +1,34 @@
+require 'nokogiri'
+
 module OpenEHR
   module Parser
     class Base
+      # Explicit, safe Nokogiri ParseOptions for untrusted OPT/archetype XML.
+      # Deliberately lists RECOVER|NONET|BIG_LINES by name rather than
+      # referencing Nokogiri::XML::ParseOptions::DEFAULT_XML - the whole
+      # point is to not silently follow that constant if a future Nokogiri
+      # release (or a downstream app pinning an older one) changes it.
+      #
+      # - RECOVER: parse malformed-but-well-intentioned XML leniently
+      #   (matches today's implicit default; see
+      #   docs/design/xxe-safe-parse-options-plan.md for real-fixture
+      #   evidence that at least one downstream consumer OPT currently
+      #   depends on this).
+      # - NONET: forbid network access during parsing. Nokogiri's own docs:
+      #   "UNSAFE to unset this option" for untrusted input.
+      # - BIG_LINES: line numbers as `long int`, unrelated to safety.
+      # - NOENT (entity substitution) and DTDLOAD (external DTD subset
+      #   loading) are deliberately NOT set - both default off in Nokogiri
+      #   and both documented "UNSAFE to set...for untrusted documents".
+      #   This is what actually gates XXE (see the plan's attack-proof
+      #   section: enabling either makes local-file and external-DTD
+      #   entity resolution succeed).
+      SAFE_PARSE_OPTIONS = Nokogiri::XML::ParseOptions.new(
+        Nokogiri::XML::ParseOptions::RECOVER |
+        Nokogiri::XML::ParseOptions::NONET |
+        Nokogiri::XML::ParseOptions::BIG_LINES
+      )
+
       attr_reader :filename
 
       def initialize(filename)

data/lib/openehr/version.rb

@@ -1,3 +1,3 @@
 module OpenEHR
-  VERSION = "2.3.1"
+  VERSION = "2.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openehr
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.3.2
 platform: ruby
 authors:
 - Shinji KOBAYASHI