rexml 3.1.9.1 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be344b60e7ffcb223b739ee96a7a98008be5177ea49c4bd2de82109438525a65
-  data.tar.gz: 57a4ed3ee747d87bdd010ce03e57a24101826b4103d3faf1e828719600d3060a
+  metadata.gz: 7c40b34860b0aa6a9f52ff95da6dc77900cec26b19aa2ff44f5273e8820925e0
+  data.tar.gz: cb09dfb7da77bb5ec5c6b2acbc810267898cdf33d5d54b7bdbebcf2452b9fee5
 SHA512:
-  metadata.gz: 874ac6300ee76cdd4d713497fa63e39aac5969b2a1f271d6cdda988db22ebffa291044eac0a2f6debae0202406fae6e6ba0fef4e5cae33159b13a478951158e0
-  data.tar.gz: 92d623b9da84327b1bde85d2564b4c1bb5c01aa431f6ec225d8fd9455a9398976b63ecfbb991ab6742e203b5f8db340393ea5cdd1c1c83aaab6d265645fe4bfe
+  metadata.gz: bc64cb9eaf9012bf1e7b5fe3b5801decced322ab4a44a19c9afffd8be8da25dd3dbdef7a7b9bba22c67d5f05b54c3fec800c73f5004d1c0e08d686ed18e96de2
+  data.tar.gz: ee8af8e28eb56469e2a27ee306d63b4dc345c4d54d11c3a44d6cae55c0bca73f613c61f95103a104082ffcaef8a38165410a73f0af779d884fe7ded558d0cbab

data/NEWS.md

@@ -1,10 +1,25 @@
 # News
 
-## 3.1.9.1 - 2021-09-02 {#version-3-1-9-1}
+## 3.2.0 - 2018-01-01 {#version-3-2-0}
 
 ### Fixes
 
-  * Backported the fix for CVE-2021-28965.
+  * Fixed a bug that no namespace attribute isn't matched with prefix.
+
+    [ruby-list:50731][Reported by Yasuhiro KIMURA]
+
+  * Fixed a bug that the default namespace is applied to attribute names.
+
+    NOTE: It's a backward incompatible change. If your program has any
+    problem with this change, please report it. We may revert this fix.
+
+    * `REXML::Attribute#prefix` returns `""` for no namespace attribute.
+
+    * `REXML::Attribute#namespace` returns `""` for no namespace attribute.
+
+### Thanks
+
+  * Yasuhiro KIMURA
 
 ## 3.1.9 - 2018-12-20 {#version-3-1-9}
 

data/lib/rexml/attribute.rb

@@ -67,15 +67,11 @@ module REXML
     #  e.add_attribute( "nsa:a", "aval" )
     #  e.add_attribute( "b", "bval" )
     #  e.attributes.get_attribute( "a" ).prefix   # -> "nsa"
-    #  e.attributes.get_attribute( "b" ).prefix   # -> "elns"
+    #  e.attributes.get_attribute( "b" ).prefix   # -> ""
     #  a = Attribute.new( "x", "y" )
     #  a.prefix                                   # -> ""
     def prefix
-      pf = super
-      if pf == ""
-        pf = @element.prefix if @element
-      end
-      pf
+      super
     end
 
     # Returns the namespace URL, if defined, or nil otherwise
@@ -86,9 +82,26 @@ module REXML
     #  e.add_attribute("nsx:a", "c")
     #  e.attribute("ns:a").namespace # => "http://url"
     #  e.attribute("nsx:a").namespace # => nil
+    #
+    # This method always returns "" for no namespace attribute. Because
+    # the default namespace doesn't apply to attribute names.
+    #
+    # From https://www.w3.org/TR/xml-names/#uniqAttrs
+    #
+    # > the default namespace does not apply to attribute names
+    #
+    #  e = REXML::Element.new("el")
+    #  e.add_namespace("", "http://example.com/")
+    #  e.namespace # => "http://example.com/"
+    #  e.add_attribute("a", "b")
+    #  e.attribute("a").namespace # => ""
     def namespace arg=nil
       arg = prefix if arg.nil?
-      @element.namespace arg
+      if arg == ""
+        ""
+      else
+        @element.namespace(arg)
+      end
     end
 
     # Returns true if other is an Attribute and has the same name and value,

data/lib/rexml/doctype.rb

@@ -7,44 +7,6 @@ require_relative 'attlistdecl'
 require_relative 'xmltokens'
 
 module REXML
-  class ReferenceWriter
-    def initialize(id_type,
-                   public_id_literal,
-                   system_literal,
-                   context=nil)
-      @id_type = id_type
-      @public_id_literal = public_id_literal
-      @system_literal = system_literal
-      if context and context[:prologue_quote] == :apostrophe
-        @default_quote = "'"
-      else
-        @default_quote = "\""
-      end
-    end
-
-    def write(output)
-      output << " #{@id_type}"
-      if @public_id_literal
-        if @public_id_literal.include?("'")
-          quote = "\""
-        else
-          quote = @default_quote
-        end
-        output << " #{quote}#{@public_id_literal}#{quote}"
-      end
-      if @system_literal
-        if @system_literal.include?("'")
-          quote = "\""
-        elsif @system_literal.include?("\"")
-          quote = "'"
-        else
-          quote = @default_quote
-        end
-        output << " #{quote}#{@system_literal}#{quote}"
-      end
-    end
-  end
-
   # Represents an XML DOCTYPE declaration; that is, the contents of <!DOCTYPE
   # ... >.  DOCTYPES can be used to declare the DTD of a document, as well as
   # being used to declare entities used in the document.
@@ -88,8 +50,6 @@ module REXML
         super( parent )
         @name = first.name
         @external_id = first.external_id
-        @long_name = first.instance_variable_get(:@long_name)
-        @uri = first.instance_variable_get(:@uri)
       elsif first.kind_of? Array
         super( parent )
         @name = first[0]
@@ -148,17 +108,19 @@ module REXML
     #   Ignored
     def write( output, indent=0, transitive=false, ie_hack=false )
       f = REXML::Formatters::Default.new
+      c = context
+      if c and c[:prologue_quote] == :apostrophe
+        quote = "'"
+      else
+        quote = "\""
+      end
       indent( output, indent )
       output << START
       output << ' '
       output << @name
-      if @external_id
-        reference_writer = ReferenceWriter.new(@external_id,
-                                               @long_name,
-                                               @uri,
-                                               context)
-        reference_writer.write(output)
-      end
+      output << " #{@external_id}" if @external_id
+      output << " #{quote}#{@long_name}#{quote}" if @long_name
+      output << " #{quote}#{@uri}#{quote}" if @uri
       unless @children.empty?
         output << ' ['
         @children.each { |child|
@@ -297,11 +259,16 @@ module REXML
     end
 
     def to_s
-      context = nil
-      context = parent.context if parent
-      notation = "<!NOTATION #{@name}"
-      reference_writer = ReferenceWriter.new(@middle, @public, @system, context)
-      reference_writer.write(notation)
+      c = nil
+      c = parent.context if parent
+      if c and c[:prologue_quote] == :apostrophe
+        quote = "'"
+      else
+        quote = "\""
+      end
+      notation = "<!NOTATION #{@name} #{@middle}"
+      notation << " #{quote}#{@public}#{quote}" if @public
+      notation << " #{quote}#{@system}#{quote}" if @system
       notation << ">"
       notation
     end

data/lib/rexml/element.rb

@@ -1132,16 +1132,18 @@ module REXML
         old_attr[value.prefix] = value
       elsif old_attr.prefix != value.prefix
         # Check for conflicting namespaces
-        raise ParseException.new(
-          "Namespace conflict in adding attribute \"#{value.name}\": "+
-          "Prefix \"#{old_attr.prefix}\" = "+
-          "\"#{@element.namespace(old_attr.prefix)}\" and prefix "+
-          "\"#{value.prefix}\" = \"#{@element.namespace(value.prefix)}\"") if
-          value.prefix != "xmlns" and old_attr.prefix != "xmlns" and
-          @element.namespace( old_attr.prefix ) ==
-            @element.namespace( value.prefix )
-          store value.name, { old_attr.prefix   => old_attr,
-            value.prefix                => value }
+        if value.prefix != "xmlns" and old_attr.prefix != "xmlns"
+          old_namespace = old_attr.namespace
+          new_namespace = value.namespace
+          if old_namespace == new_namespace
+            raise ParseException.new(
+                    "Namespace conflict in adding attribute \"#{value.name}\": "+
+                    "Prefix \"#{old_attr.prefix}\" = \"#{old_namespace}\" and "+
+                    "prefix \"#{value.prefix}\" = \"#{new_namespace}\"")
+          end
+        end
+        store value.name, {old_attr.prefix => old_attr,
+                           value.prefix    => value}
       else
         store value.name, value
       end

data/lib/rexml/parsers/baseparser.rb

@@ -50,6 +50,7 @@ module REXML
 
       DOCTYPE_START = /\A\s*<!DOCTYPE\s/um
       DOCTYPE_END = /\A\s*\]\s*>/um
+      DOCTYPE_PATTERN = /\s*<!DOCTYPE\s+(.*?)(\[|>)/um
       ATTRIBUTE_PATTERN = /\s*(#{QNAME_STR})\s*=\s*(["'])(.*?)\4/um
       COMMENT_START = /\A<!--/u
       COMMENT_PATTERN = /<!--(.*?)-->/um
@@ -60,14 +61,15 @@ module REXML
       XMLDECL_PATTERN = /<\?xml\s+(.*?)\?>/um
       INSTRUCTION_START = /\A<\?/u
       INSTRUCTION_PATTERN = /<\?#{NAME}(\s+.*?)?\?>/um
-      TAG_MATCH = /\A<((?>#{QNAME_STR}))/um
-      CLOSE_MATCH = /\A\s*<\/(#{QNAME_STR})\s*>/um
+      TAG_MATCH = /^<((?>#{QNAME_STR}))/um
+      CLOSE_MATCH = /^\s*<\/(#{QNAME_STR})\s*>/um
 
       VERSION = /\bversion\s*=\s*["'](.*?)['"]/um
       ENCODING = /\bencoding\s*=\s*["'](.*?)['"]/um
       STANDALONE = /\bstandalone\s*=\s*["'](.*?)['"]/um
 
       ENTITY_START = /\A\s*<!ENTITY/
+      IDENTITY = /^([!\*\w\-]+)(\s+#{NCNAME_STR})?(\s+["'](.*?)['"])?(\s+['"](.*?)["'])?/u
       ELEMENTDECL_START = /\A\s*<!ELEMENT/um
       ELEMENTDECL_PATTERN = /\A\s*(<!ELEMENT.*?)>/um
       SYSTEMENTITY = /\A\s*(%.*?;)\s*$/um
@@ -81,6 +83,9 @@ module REXML
       ATTDEF_RE = /#{ATTDEF}/
       ATTLISTDECL_START = /\A\s*<!ATTLIST/um
       ATTLISTDECL_PATTERN = /\A\s*<!ATTLIST\s+#{NAME}(?:#{ATTDEF})*\s*>/um
+      NOTATIONDECL_START = /\A\s*<!NOTATION/um
+      PUBLIC = /\A\s*<!NOTATION\s+(\w[\-\w]*)\s+(PUBLIC)\s+(["'])(.*?)\3(?:\s+(["'])(.*?)\5)?\s*>/um
+      SYSTEM = /\A\s*<!NOTATION\s+(\w[\-\w]*)\s+(SYSTEM)\s+(["'])(.*?)\3\s*>/um
 
       TEXT_PATTERN = /\A([^<]*)/um
 
@@ -98,11 +103,6 @@ module REXML
       GEDECL = "<!ENTITY\\s+#{NAME}\\s+#{ENTITYDEF}\\s*>"
       ENTITYDECL = /\s*(?:#{GEDECL})|(?:#{PEDECL})/um
 
-      NOTATIONDECL_START = /\A\s*<!NOTATION/um
-      EXTERNAL_ID_PUBLIC = /\A\s*PUBLIC\s+#{PUBIDLITERAL}\s+#{SYSTEMLITERAL}\s*/um
-      EXTERNAL_ID_SYSTEM = /\A\s*SYSTEM\s+#{SYSTEMLITERAL}\s*/um
-      PUBLIC_ID = /\A\s*PUBLIC\s+#{PUBIDLITERAL}\s*/um
-
       EREFERENCE = /&(?!#{NAME};)/
 
       DEFAULT_ENTITIES = {
@@ -195,9 +195,11 @@ module REXML
         return [ :end_document ] if empty?
         return @stack.shift if @stack.size > 0
         #STDERR.puts @source.encoding
+        @source.read if @source.buffer.size<2
         #STDERR.puts "BUFFER = #{@source.buffer.inspect}"
         if @document_status == nil
-          word = @source.match( /\A((?:\s+)|(?:<[^>]*>))/um )
+          #@source.consume( /^\s*/um )
+          word = @source.match( /^((?:\s+)|(?:<[^>]*>))/um )
           word = word[1] unless word.nil?
           #STDERR.puts "WORD = #{word.inspect}"
           case word
@@ -222,49 +224,38 @@ module REXML
           when INSTRUCTION_START
             return process_instruction
           when DOCTYPE_START
-            base_error_message = "Malformed DOCTYPE"
-            @source.match(DOCTYPE_START, true)
+            md = @source.match( DOCTYPE_PATTERN, true )
             @nsstack.unshift(curr_ns=Set.new)
-            name = parse_name(base_error_message)
-            if @source.match(/\A\s*\[/um, true)
-              id = [nil, nil, nil]
-              @document_status = :in_doctype
-            elsif @source.match(/\A\s*>/um, true)
-              id = [nil, nil, nil]
+            identity = md[1]
+            close = md[2]
+            identity =~ IDENTITY
+            name = $1
+            raise REXML::ParseException.new("DOCTYPE is missing a name") if name.nil?
+            pub_sys = $2.nil? ? nil : $2.strip
+            long_name = $4.nil? ? nil : $4.strip
+            uri = $6.nil? ? nil : $6.strip
+            args = [ :start_doctype, name, pub_sys, long_name, uri ]
+            if close == ">"
               @document_status = :after_doctype
-            else
-              id = parse_id(base_error_message,
-                            accept_external_id: true,
-                            accept_public_id: false)
-              if id[0] == "SYSTEM"
-                # For backward compatibility
-                id[1], id[2] = id[2], nil
-              end
-              if @source.match(/\A\s*\[/um, true)
-                @document_status = :in_doctype
-              elsif @source.match(/\A\s*>/um, true)
-                @document_status = :after_doctype
-              else
-                message = "#{base_error_message}: garbage after external ID"
-                raise REXML::ParseException.new(message, @source)
-              end
-            end
-            args = [:start_doctype, name, *id]
-            if @document_status == :after_doctype
-              @source.match(/\A\s*/um, true)
+              @source.read if @source.buffer.size<2
+              md = @source.match(/^\s*/um, true)
               @stack << [ :end_doctype ]
+            else
+              @document_status = :in_doctype
             end
             return args
-          when /\A\s+/
+          when /^\s+/
           else
             @document_status = :after_doctype
+            @source.read if @source.buffer.size<2
+            md = @source.match(/\s*/um, true)
             if @source.encoding == "UTF-8"
               @source.buffer.force_encoding(::Encoding::UTF_8)
             end
           end
         end
         if @document_status == :in_doctype
-          md = @source.match(/\A\s*(.*?>)/um)
+          md = @source.match(/\s*(.*?>)/um)
           case md[1]
           when SYSTEMENTITY
             match = @source.match( SYSTEMENTITY, true )[1]
@@ -321,35 +312,24 @@ module REXML
             end
             return [ :attlistdecl, element, pairs, contents ]
           when NOTATIONDECL_START
-            base_error_message = "Malformed notation declaration"
-            unless @source.match(/\A\s*<!NOTATION\s+/um, true)
-              if @source.match(/\A\s*<!NOTATION\s*>/um)
-                message = "#{base_error_message}: name is missing"
-              else
-                message = "#{base_error_message}: invalid declaration name"
-              end
-              raise REXML::ParseException.new(message, @source)
-            end
-            name = parse_name(base_error_message)
-            id = parse_id(base_error_message,
-                          accept_external_id: true,
-                          accept_public_id: true)
-            unless @source.match(/\A\s*>/um, true)
-              message = "#{base_error_message}: garbage before end >"
-              raise REXML::ParseException.new(message, @source)
+            md = nil
+            if @source.match( PUBLIC )
+              md = @source.match( PUBLIC, true )
+              vals = [md[1],md[2],md[4],md[6]]
+            elsif @source.match( SYSTEM )
+              md = @source.match( SYSTEM, true )
+              vals = [md[1],md[2],nil,md[4]]
+            else
+              raise REXML::ParseException.new( "error parsing notation: no matching pattern", @source )
             end
-            return [:notationdecl, name, *id]
+            return [ :notationdecl, *vals ]
           when DOCTYPE_END
             @document_status = :after_doctype
             @source.match( DOCTYPE_END, true )
             return [ :end_doctype ]
           end
         end
-        if @document_status == :after_doctype
-          @source.match(/\A\s*/um, true)
-        end
         begin
-          @source.read if @source.buffer.size<2
           if @source.buffer[0] == ?<
             if @source.buffer[1] == ?/
               @nsstack.shift
@@ -388,7 +368,6 @@ module REXML
               unless md
                 raise REXML::ParseException.new("malformed XML: missing tag start", @source)
               end
-              @document_status = :in_element
               prefixes = Set.new
               prefixes << md[2] if md[2]
               @nsstack.unshift(curr_ns=Set.new)
@@ -494,85 +473,6 @@ module REXML
         true
       end
 
-      def parse_name(base_error_message)
-        md = @source.match(/\A\s*#{NAME}/um, true)
-        unless md
-          if @source.match(/\A\s*\S/um)
-            message = "#{base_error_message}: invalid name"
-          else
-            message = "#{base_error_message}: name is missing"
-          end
-          raise REXML::ParseException.new(message, @source)
-        end
-        md[1]
-      end
-
-      def parse_id(base_error_message,
-                   accept_external_id:,
-                   accept_public_id:)
-        if accept_external_id and (md = @source.match(EXTERNAL_ID_PUBLIC, true))
-          pubid = system = nil
-          pubid_literal = md[1]
-          pubid = pubid_literal[1..-2] if pubid_literal # Remove quote
-          system_literal = md[2]
-          system = system_literal[1..-2] if system_literal # Remove quote
-          ["PUBLIC", pubid, system]
-        elsif accept_public_id and (md = @source.match(PUBLIC_ID, true))
-          pubid = system = nil
-          pubid_literal = md[1]
-          pubid = pubid_literal[1..-2] if pubid_literal # Remove quote
-          ["PUBLIC", pubid, nil]
-        elsif accept_external_id and (md = @source.match(EXTERNAL_ID_SYSTEM, true))
-          system = nil
-          system_literal = md[1]
-          system = system_literal[1..-2] if system_literal # Remove quote
-          ["SYSTEM", nil, system]
-        else
-          details = parse_id_invalid_details(accept_external_id: accept_external_id,
-                                             accept_public_id: accept_public_id)
-          message = "#{base_error_message}: #{details}"
-          raise REXML::ParseException.new(message, @source)
-        end
-      end
-
-      def parse_id_invalid_details(accept_external_id:,
-                                   accept_public_id:)
-        public = /\A\s*PUBLIC/um
-        system = /\A\s*SYSTEM/um
-        if (accept_external_id or accept_public_id) and @source.match(/#{public}/um)
-          if @source.match(/#{public}(?:\s+[^'"]|\s*[\[>])/um)
-            return "public ID literal is missing"
-          end
-          unless @source.match(/#{public}\s+#{PUBIDLITERAL}/um)
-            return "invalid public ID literal"
-          end
-          if accept_public_id
-            if @source.match(/#{public}\s+#{PUBIDLITERAL}\s+[^'"]/um)
-              return "system ID literal is missing"
-            end
-            unless @source.match(/#{public}\s+#{PUBIDLITERAL}\s+#{SYSTEMLITERAL}/um)
-              return "invalid system literal"
-            end
-            "garbage after system literal"
-          else
-            "garbage after public ID literal"
-          end
-        elsif accept_external_id and @source.match(/#{system}/um)
-          if @source.match(/#{system}(?:\s+[^'"]|\s*[\[>])/um)
-            return "system literal is missing"
-          end
-          unless @source.match(/#{system}\s+#{SYSTEMLITERAL}/um)
-            return "invalid system literal"
-          end
-          "garbage after system literal"
-        else
-          unless @source.match(/\A\s*(?:PUBLIC|SYSTEM)\s/um)
-            return "invalid ID type"
-          end
-          "ID type is missing"
-        end
-      end
-
       def process_instruction
         match_data = @source.match(INSTRUCTION_PATTERN, true)
         unless match_data

data/lib/rexml/rexml.rb

@@ -24,7 +24,7 @@
 module REXML
   COPYRIGHT = "Copyright © 2001-2008 Sean Russell <ser@germane-software.com>"
   DATE = "2008/019"
-  VERSION = "3.1.9.1"
+  VERSION = "3.2.0"
   REVISION = ""
 
   Copyright = COPYRIGHT

data/lib/rexml/xpath_parser.rb

@@ -493,9 +493,7 @@ module REXML
               if prefix.nil?
                 raw_node.name == name
               elsif prefix.empty?
-                # FIXME: This DOUBLES the time XPath searches take
-                raw_node.name == name and
-                  raw_node.namespace == raw_node.element.namespace
+                raw_node.name == name and raw_node.namespace == ""
               else
                 # FIXME: This DOUBLES the time XPath searches take
                 ns = get_namespace(raw_node.element, prefix)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rexml
 version: !ruby/object:Gem::Version
-  version: 3.1.9.1
+  version: 3.2.0
 platform: ruby
 authors:
 - Kouhei Sutou
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-09-02 00:00:00.000000000 Z
+date: 2018-12-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -122,7 +122,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.0.dev
+rubygems_version: 3.0.1
 signing_key: 
 specification_version: 4
 summary: An XML toolkit for Ruby