ox 2.14.28 → 2.14.29

data/ext/ox/ox.c

@@ -11,6 +11,13 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+// Not defined by every C library, and it is only these three bits.
+#ifndef S_ISREG
+#define S_ISREG(m) (((m) & S_IFMT) == S_IFREG)
+#endif
 
 #include "intern.h"
 #include "ruby.h"
@@ -73,6 +80,7 @@ ID ox_start_element_id;
 ID ox_string_id;
 ID ox_text_id;
 ID ox_to_c_id;
+ID ox_utc_offset_id;
 ID ox_value_id;
 
 VALUE ox_encoding_sym;
@@ -168,7 +176,7 @@ struct _options ox_default_options = {
     SpcSkip,       // skip
     No,            // smart
     true,          // convert_special
-    No,            // allow_invalid
+    NotSet,        // allow_invalid
     false,         // no_empty
     false,         // with_cdata
     {'\0'},        // inv_repl
@@ -282,8 +290,11 @@ static VALUE hints_to_overlay(Hints hints) {
  * - _:skip_ [:skip_none|:skip_return|:skip_white|:skip_off] determines how to handle white space in text
  * - _:smart_ [true|false|nil] flag indicating the SAX parser uses hints if available (use with html)
  * - _:convert_special_ [true|false|nil] flag indicating special characters like &lt; are converted with the SAX parser
- * - _:invalid_replace_ [nil|String] replacement string for invalid XML characters on dump. nil indicates include anyway
- * as hex. A string, limited to 10 characters will replace the invalid character with the replace.
+ * - _:invalid_replace_ [nil|false|String] what to do with a character XML can not hold on dump. false, the default,
+ * raises an Ox::SyntaxError. nil writes it as a hex character reference, other than a NUL which is dropped since
+ * &#x0000; can not be read back. A string, limited to 10 characters, replaces it and the empty string drops it. This
+ * covers text and attribute values. A comment, CDATA section, DOCTYPE or processing instruction expands no character
+ * reference, so a character XML can not hold always raises there.
  * - _:no_empty_ [true|false|nil] flag indicating there should be no empty elements in a dump
  * - _:with_cdata_ [true|false] includes cdata in hash_load results
  * - _:strip_namespace_ [String|true|false] false or "" results in no namespace stripping. A string of "*" or true will
@@ -359,12 +370,14 @@ static VALUE get_def_opts(VALUE self) {
     case SpcSkip: rb_hash_aset(opts, skip_sym, skip_white_sym); break;
     default: rb_hash_aset(opts, skip_sym, Qnil); break;
     }
-    if (Yes == ox_default_options.allow_invalid) {
-        rb_hash_aset(opts, invalid_replace_sym, Qnil);
-    } else {
+    switch (ox_default_options.allow_invalid) {
+    case Yes: rb_hash_aset(opts, invalid_replace_sym, Qnil); break;
+    case No:
         rb_hash_aset(opts,
                      invalid_replace_sym,
                      rb_str_new(ox_default_options.inv_repl + 1, (int)*ox_default_options.inv_repl));
+        break;
+    default: rb_hash_aset(opts, invalid_replace_sym, Qfalse); break;
     }
     if ('\0' == *ox_default_options.strip_ns) {
         rb_hash_aset(opts, strip_namespace_sym, Qfalse);
@@ -443,8 +456,11 @@ static VALUE sax_html_overlay(VALUE self) {
  *   - _:attr_key_mod_ [Proc|nil] converts attribute keys on parse if not nil
  *   - _:skip_ [:skip_none|:skip_return|:skip_white|:skip_off] determines how to handle white space in text
  *   - _:smart_ [true|false|nil] flag indicating the SAX parser uses hints if available (use with html)
- *   - _:invalid_replace_ [nil|String] replacement string for invalid XML characters on dump. nil indicates include
- * anyway as hex. A string, limited to 10 characters will replace the invalid character with the replace.
+ *   - _:invalid_replace_ [nil|false|String] what to do with a character XML can not hold on dump. false, the default,
+ * raises an Ox::SyntaxError. nil writes it as a hex character reference, other than a NUL which is dropped since
+ * &#x0000; can not be read back. A string, limited to 10 characters, replaces it and the empty string drops it. This
+ * covers text and attribute values. A comment, CDATA section, DOCTYPE or processing instruction expands no character
+ * reference, so a character XML can not hold always raises there.
  *   - _:strip_namespace_ [nil|String|true|false] "" or false result in no namespace stripping. A string of "*" or true
  * will strip all namespaces. Any other non-empty string indicates that matching namespaces will be stripped.
  * - _:with_cdata_ [true|false] includes cdata in hash_load results
@@ -474,7 +490,10 @@ static VALUE set_def_opts(VALUE self, VALUE opts) {
 
     v = rb_hash_aref(opts, ox_encoding_sym);
     if (Qnil == v) {
+        // Ox.parse_obj and Ox.parse read rb_enc and never re-derive it from the
+        // name, so clearing only the name leaves them on the old encoding.
         *ox_default_options.encoding = '\0';
+        ox_default_options.rb_enc    = 0;
     } else {
         Check_Type(v, T_STRING);
         strncpy(ox_default_options.encoding, StringValuePtr(v), sizeof(ox_default_options.encoding) - 1);
@@ -483,8 +502,19 @@ static VALUE set_def_opts(VALUE self, VALUE opts) {
 
     v = rb_hash_aref(opts, ox_indent_sym);
     if (Qnil != v) {
+        int indent;
+
         Check_Type(v, T_FIXNUM);
-        ox_default_options.indent = FIX2INT(v);
+        indent = FIX2INT(v);
+        // Bound the indent so that depth * indent (depth up to MAX_DEPTH) cannot
+        // overflow the int arithmetic in dump.c and smash the output buffer.
+        // Any negative value already means "tight, no newlines"; normalize it.
+        if (indent < 0) {
+            indent = -1;
+        } else if (OX_MAX_INDENT < indent) {
+            rb_raise(ox_parse_error_class, ":indent can be no larger than %d.\n", OX_MAX_INDENT);
+        }
+        ox_default_options.indent = indent;
     }
 
     v = rb_hash_aref(opts, trace_sym);
@@ -560,9 +590,19 @@ static VALUE set_def_opts(VALUE self, VALUE opts) {
         rb_raise(ox_parse_error_class, ":no_empty must be true or false.\n");
     }
 
-    v = rb_hash_aref(opts, invalid_replace_sym);
+    v = rb_hash_lookup(opts, invalid_replace_sym);
     if (Qnil == v) {
-        ox_default_options.allow_invalid = Yes;
+        // A key that is not there asks for the default, an explicit nil asks for
+        // the character to be written out, so the two cannot share a branch.
+        if (Qtrue == rb_funcall(opts, has_key_id, 1, invalid_replace_sym)) {
+            ox_default_options.allow_invalid = Yes;
+        } else {
+            ox_default_options.allow_invalid = NotSet;
+            *ox_default_options.inv_repl     = '\0';
+        }
+    } else if (Qfalse == v) {
+        ox_default_options.allow_invalid = NotSet;
+        *ox_default_options.inv_repl     = '\0';
     } else {
         long slen;
 
@@ -665,31 +705,63 @@ static VALUE set_def_opts(VALUE self, VALUE opts) {
  * - +xml+ [String] XML String in optimized Object format.
  * *return* [Object] deserialized Object.
  */
+// Arguments for an object-mode parse that runs with GC disabled.
+struct _objParse {
+    char   *xml;
+    size_t  len;
+    Options options;
+    Err     err;
+};
+
+static VALUE obj_parse_body(VALUE argsv) {
+    struct _objParse *args = (struct _objParse *)argsv;
+
+    return ox_parse(args->xml, args->len, ox_obj_callbacks, 0, args->options, args->err);
+}
+
+// rb_gc_disable() returns Qtrue when GC was already disabled. Only re-enable
+// when this call is the one that disabled it. Runs even if the parse raised.
+static VALUE obj_parse_reenable(VALUE was_disabled) {
+    if (Qtrue != was_disabled) {
+        rb_gc_enable();
+    }
+    return Qnil;
+}
+
 static VALUE to_obj(VALUE self, VALUE ruby_xml) {
-    char           *xml, *x;
-    size_t          len;
-    VALUE           obj;
-    struct _options options = ox_default_options;
-    struct _err     err;
+    char            *xml, *x, *str;
+    size_t           len;
+    VALUE            obj;
+    VALUE            was_disabled;
+    struct _options  options = ox_default_options;
+    struct _err      err;
+    struct _objParse args;
 
     err_init(&err);
     Check_Type(ruby_xml, T_STRING);
     /* the xml string gets modified so make a copy of it */
+    str = StringValuePtr(ruby_xml);
     len = RSTRING_LEN(ruby_xml) + 1;
-    x   = defuse_bom(StringValuePtr(ruby_xml), &options);
+    x   = defuse_bom(str, &options);
+    // Drop the BOM from len as well, otherwise the copy below reads past the
+    // end of the Ruby string and xml is left without a terminating '\0'.
+    len -= (size_t)(x - str);
     if (SMALL_XML < len) {
         xml = ALLOC_N(char, len);
     } else {
         xml = ALLOCA_N(char, len);
     }
     memcpy(xml, x, len);
-    rb_gc_disable();
-    obj = ox_parse(xml, len - 1, ox_obj_callbacks, 0, &options, &err);
+    args.xml     = xml;
+    args.len     = len - 1;
+    args.options = &options;
+    args.err     = &err;
+    was_disabled = rb_gc_disable();
+    obj          = rb_ensure(obj_parse_body, (VALUE)&args, obj_parse_reenable, was_disabled);
     if (SMALL_XML < len) {
         xfree(xml);
     }
     RB_GC_GUARD(obj);
-    rb_gc_enable();
     if (err_has(&err)) {
         ox_err_raise(&err);
     }
@@ -705,7 +777,7 @@ static VALUE to_obj(VALUE self, VALUE ruby_xml) {
  * _raise_ [Exception] if the XML is malformed.
  */
 static VALUE to_gen(VALUE self, VALUE ruby_xml) {
-    char           *xml, *x;
+    char           *xml, *x, *str;
     size_t          len;
     VALUE           obj;
     struct _options options = ox_default_options;
@@ -714,8 +786,12 @@ static VALUE to_gen(VALUE self, VALUE ruby_xml) {
     err_init(&err);
     Check_Type(ruby_xml, T_STRING);
     /* the xml string gets modified so make a copy of it */
+    str = StringValuePtr(ruby_xml);
     len = RSTRING_LEN(ruby_xml) + 1;
-    x   = defuse_bom(StringValuePtr(ruby_xml), &options);
+    x   = defuse_bom(str, &options);
+    // Drop the BOM from len as well, otherwise the copy below reads past the
+    // end of the Ruby string and xml is left without a terminating '\0'.
+    len -= (size_t)(x - str);
     if (SMALL_XML < len) {
         xml = ALLOC_N(char, len);
     } else {
@@ -789,6 +865,9 @@ static int load_options_cb(VALUE k, VALUE v, VALUE opts) {
     } else if (invalid_replace_sym == k) {
         if (Qnil == v) {
             copts->allow_invalid = Yes;
+        } else if (Qfalse == v) {
+            copts->allow_invalid = NotSet;
+            *copts->inv_repl     = '\0';
         } else {
             long slen;
 
@@ -845,6 +924,7 @@ static int load_options_cb(VALUE k, VALUE v, VALUE opts) {
 
 static VALUE load(char *xml, size_t len, int argc, VALUE *argv, VALUE self, VALUE encoding, Err err) {
     VALUE           obj;
+    char           *body;
     struct _options options = ox_default_options;
 
     if (1 == argc && rb_cHash == rb_obj_class(*argv)) {
@@ -859,14 +939,21 @@ static VALUE load(char *xml, size_t len, int argc, VALUE *argv, VALUE self, VALU
     } else if (0 == options.rb_enc) {
         options.rb_enc = rb_enc_find(options.encoding);
     }
-    xml = defuse_bom(xml, &options);
+    // Shorten len by the size of the BOM so that xml + len stays the address
+    // of the terminating '\0' rather than running past the end of the buffer.
+    body = defuse_bom(xml, &options);
+    len -= (size_t)(body - xml);
+    xml = body;
     switch (options.mode) {
-    case ObjMode:
-        rb_gc_disable();
-        obj = ox_parse(xml, len, ox_obj_callbacks, 0, &options, err);
+    case ObjMode: {
+        struct _objParse args = {xml, len, &options, err};
+        VALUE            was_disabled;
+
+        was_disabled = rb_gc_disable();
+        obj          = rb_ensure(obj_parse_body, (VALUE)&args, obj_parse_reenable, was_disabled);
         RB_GC_GUARD(obj);
-        rb_gc_enable();
         break;
+    }
     case GenMode: obj = ox_parse(xml, len, ox_gen_callbacks, 0, &options, err); break;
     case LimMode: obj = ox_parse(xml, len, ox_limited_callbacks, 0, &options, err); break;
     case HashMode:
@@ -905,14 +992,24 @@ static VALUE load(char *xml, size_t len, int argc, VALUE *argv, VALUE self, VALU
  *     - _:limited_ - read as a generic XML file but with callbacks on text and elements events only
  *     - _:hash_ - read and convert to a Hash and core class objects only
  *     - _:hash_no_attrs_ - read and convert to a Hash and core class objects only without capturing attributes
+ *
+ *     If neither this option nor Ox.default_options[:mode] is set the document
+ *     may pick the mode itself with an <?ox mode="generic"?> or an
+ *     <?ox mode="limited"?> processing instruction. A document can never pick
+ *     object mode. Only the caller can, with mode: :object, since object mode
+ *     allocates the classes the document names and sets their instance
+ *     variables without calling initialize.
  *   - *:effort* [:strict|:tolerant|:auto_define] effort to use when an undefined class is encountered, default: :strict
  *     - _:strict_ - raise an NameError for missing classes and modules
  *     - _:tolerant_ - return nil for missing classes and modules
  *     - _:auto_define_ - auto define missing classes and modules
  *   - *:trace* [Fixnum] trace level as a Fixnum, default: 0 (silent)
  *   - *:symbolize_keys* [true|false|nil] symbolize element attribute keys or leave as Strings
- *   - *:invalid_replace* [nil|String] replacement string for invalid XML characters on dump. nil indicates include
- * anyway as hex. A string, limited to 10 characters will replace the invalid character with the replace.
+ *   - *:invalid_replace* [nil|false|String] what to do with a character XML can not hold on dump. false, the default,
+ * raises an Ox::SyntaxError. nil writes it as a hex character reference, other than a NUL which is dropped since
+ * &#x0000; can not be read back. A string, limited to 10 characters, replaces it and the empty string drops it. This
+ * covers text and attribute values. A comment, CDATA section, DOCTYPE or processing instruction expands no character
+ * reference, so a character XML can not hold always raises there.
  *   - *:strip_namespace* [String|true|false] "" or false result in no namespace stripping. A string of "*" or true will
  * strip all namespaces. Any other non-empty string indicates that matching namespaces will be stripped.
  *   - *:with_cdata* [true|false] if true cdata is included in hash_load output otherwise it is not.
@@ -924,6 +1021,9 @@ static VALUE load_str(int argc, VALUE *argv, VALUE self) {
     VALUE       encoding;
     struct _err err;
 
+    if (1 > argc) {
+        rb_raise(ox_arg_error_class, "missing XML string");
+    }
     err_init(&err);
     Check_Type(*argv, T_STRING);
     /* the xml string gets modified so make a copy of it */
@@ -959,14 +1059,24 @@ static VALUE load_str(int argc, VALUE *argv, VALUE self) {
  *     - _:limited_ - read as a generic XML file but with callbacks on text and elements events only
  *     - _:hash_ - read and convert to a Hash and core class objects only
  *     - _:hash_no_attrs_ - read and convert to a Hash and core class objects only without capturing attributes
+ *
+ *     If neither this option nor Ox.default_options[:mode] is set the document
+ *     may pick the mode itself with an <?ox mode="generic"?> or an
+ *     <?ox mode="limited"?> processing instruction. A document can never pick
+ *     object mode. Only the caller can, with mode: :object, since object mode
+ *     allocates the classes the document names and sets their instance
+ *     variables without calling initialize.
  *   - *:effort* [:strict|:tolerant|:auto_define] effort to use when an undefined class is encountered, default: :strict
  *     - _:strict_ - raise an NameError for missing classes and modules
  *     - _:tolerant_ - return nil for missing classes and modules
  *     - _:auto_define_ - auto define missing classes and modules
  *   - *:trace* [Fixnum] trace level as a Fixnum, default: 0 (silent)
  *   - *:symbolize_keys* [true|false|nil] symbolize element attribute keys or leave as Strings
- *   - *:invalid_replace* [nil|String] replacement string for invalid XML characters on dump. nil indicates include
- * anyway as hex. A string, limited to 10 characters will replace the invalid character with the replace.
+ *   - *:invalid_replace* [nil|false|String] what to do with a character XML can not hold on dump. false, the default,
+ * raises an Ox::SyntaxError. nil writes it as a hex character reference, other than a NUL which is dropped since
+ * &#x0000; can not be read back. A string, limited to 10 characters, replaces it and the empty string drops it. This
+ * covers text and attribute values. A comment, CDATA section, DOCTYPE or processing instruction expands no character
+ * reference, so a character XML can not hold always raises there.
  *   - *:strip_namespace* [String|true|false] "" or false result in no namespace stripping. A string of "*" or true will
  * strip all namespaces. Any other non-empty string indicates that matching namespaces will be stripped.
  */
@@ -975,23 +1085,34 @@ static VALUE load_file(int argc, VALUE *argv, VALUE self) {
     char       *xml;
     FILE       *f;
     off_t       len;
+    struct stat st;
     VALUE       obj;
     struct _err err;
 
+    if (1 > argc) {
+        rb_raise(ox_arg_error_class, "missing file path");
+    }
     err_init(&err);
     Check_Type(*argv, T_STRING);
     path = StringValuePtr(*argv);
-    if (0 == (f = fopen(path, "r"))) {
+    if (0 == (f = fopen(path, "rb"))) {
         rb_raise(rb_eIOError, "%s\n", strerror(errno));
     }
-    fseek(f, 0, SEEK_END);
-    len = ftello(f);
+    // A stream that can not seek leaves len at -1, which allocates nothing and
+    // then asks fread for SIZE_MAX bytes.
+    // Only a regular file has a size worth sizing a read from. A FIFO reports
+    // -1, and a directory can report anything at all, including off_t's
+    // maximum.
+    if (0 != fstat(fileno(f), &st) || !S_ISREG(st.st_mode)) {
+        fclose(f);
+        rb_raise(rb_eIOError, "%s is not a regular file.\n", path);
+    }
+    len = st.st_size;
     if (SMALL_XML < len) {
-        xml = ALLOC_N(char, len + 1);
+        xml = ALLOC_N(char, (size_t)len + 1);
     } else {
-        xml = ALLOCA_N(char, len + 1);
+        xml = ALLOCA_N(char, (size_t)len + 1);
     }
-    fseek(f, 0, SEEK_SET);
     if ((size_t)len != fread(xml, 1, len, f)) {
         ox_err_set(&err, rb_eLoadError, "Failed to read %ld bytes from %s.\n", (long)len, path);
         obj = Qnil;
@@ -1178,10 +1299,20 @@ static void parse_dump_options(VALUE ropts, Options copts) {
         VALUE v;
 
         if (Qnil != (v = rb_hash_lookup(ropts, ox_indent_sym))) {
+            int indent;
+
             if (rb_cInteger != rb_obj_class(v) && T_FIXNUM != rb_type(v)) {
                 rb_raise(ox_parse_error_class, ":indent must be a Fixnum.\n");
             }
-            copts->indent = NUM2INT(v);
+            indent = NUM2INT(v);
+            // See load_default_options(): bound indent to avoid int overflow in
+            // the dump.c indent arithmetic (oj CVE-2026-54502 class of bug).
+            if (indent < 0) {
+                indent = -1;
+            } else if (OX_MAX_INDENT < indent) {
+                rb_raise(ox_parse_error_class, ":indent can be no larger than %d.\n", OX_MAX_INDENT);
+            }
+            copts->indent = indent;
         }
         if (Qnil != (v = rb_hash_lookup(ropts, trace_sym))) {
             if (rb_cInteger != rb_obj_class(v) && T_FIXNUM != rb_type(v)) {
@@ -1214,6 +1345,9 @@ static void parse_dump_options(VALUE ropts, Options copts) {
             if (Qtrue == rb_funcall(ropts, has_key_id, 1, invalid_replace_sym)) {
                 copts->allow_invalid = Yes;
             }
+        } else if (Qfalse == v) {
+            copts->allow_invalid = NotSet;
+            *copts->inv_repl     = '\0';
         } else {
             long slen;
 
@@ -1286,6 +1420,9 @@ static VALUE dump(int argc, VALUE *argv, VALUE self) {
     struct _options copts = ox_default_options;
     VALUE           rstr;
 
+    if (1 > argc) {
+        rb_raise(ox_arg_error_class, "missing object to dump");
+    }
     if (2 == argc) {
         parse_dump_options(argv[1], &copts);
     }
@@ -1348,6 +1485,9 @@ static VALUE to_xml(int argc, VALUE *argv, VALUE self) {
 static VALUE to_file(int argc, VALUE *argv, VALUE self) {
     struct _options copts = ox_default_options;
 
+    if (2 > argc) {
+        rb_raise(ox_arg_error_class, "missing file path or object to write");
+    }
     if (3 == argc) {
         parse_dump_options(argv[2], &copts);
     }
@@ -1447,6 +1587,7 @@ void Init_ox(void) {
     ox_string_id            = rb_intern("string");
     ox_text_id              = rb_intern("text");
     ox_to_c_id              = rb_intern("to_c");
+    ox_utc_offset_id        = rb_intern("utc_offset");
     ox_value_id             = rb_intern("value");
 
     encoding_id = rb_intern("encoding");

data/ext/ox/ox.h

@@ -34,6 +34,14 @@ extern "C" {
 #define raise_error(msg, xml, current) _ox_raise_error(msg, xml, current, __FILE__, __LINE__)
 
 #define MAX_TEXT_LEN 4096
+// Anything even close to the max prolog length is most likely someone trying
+// to break something.
+#define MAX_PROLOG 32767
+
+/* Upper bound for the :indent dump option. Keeps depth * indent (depth is
+ * capped at the dump MAX_DEPTH of 1000) far below INT_MAX so the indent size
+ * arithmetic in dump.c cannot overflow and under-grow the output buffer. */
+#define OX_MAX_INDENT 16384
 
 #define SILENT 0
 #define TRACE 1
@@ -90,7 +98,7 @@ typedef struct _parseCallbacks {
     void (*add_doctype)(PInfo pi, const char *docType);
     void (*add_comment)(PInfo pi, const char *comment);
     void (*add_cdata)(PInfo pi, const char *cdata, size_t len);
-    void (*add_text)(PInfo pi, char *text, int closed);
+    void (*add_text)(PInfo pi, char *text, size_t len, int closed);
     void (*add_element)(PInfo pi, const char *ename, Attr attrs, int hasChildren);
     void (*end_element)(PInfo pi, const char *ename);
     void (*finish)(PInfo pi);
@@ -151,6 +159,7 @@ struct _pInfo {
 
 extern VALUE ox_parse(char *xml, size_t len, ParseCallbacks pcb, char **endp, Options options, Err err);
 extern void  _ox_raise_error(const char *msg, const char *xml, const char *current, const char *file, int line);
+extern void  ox_circ_array_free(CircArray ca);
 
 extern void ox_sax_define(void);
 
@@ -205,6 +214,7 @@ extern ID ox_start_element_id;
 extern ID ox_string_id;
 extern ID ox_text_id;
 extern ID ox_to_c_id;
+extern ID ox_utc_offset_id;
 extern ID ox_value_id;
 
 extern rb_encoding *ox_utf8_encoding;