@@ -18,7 +18,13 @@ require 'rexml/entity'
module REXML
class Entity < Child
def unnormalized
- document.record_entity_expansion!
+ # Due to an optimisation in REXML, the default entities aren't
+ # associated with a document. As these enties are defined and
+ # not recursive, we know that expanding them won't cause any
+ # issues. Other entities in the document will still have
+ # the association to the document preventing this from opening
+ # a new attack vector.
+ document.record_entity_expansion! if document
v = value()
return nil if v.nil?
@unnormalized = Text::unnormalize(v, parent)
lib/rexml-expansion-fix.rb
@@ -1,7 +1,7 @@
Gem::Specification.new do |s|
s.name = "rexml-expansion-fix"
- s.version = "1.0.0"
- s.date = "2008-08-22"
+ s.version = "1.0.1"
+ s.date = "2008-08-31"
s.summary = "Prevents potentitial DoS attacks to rexml"
s.email = "michael@koziarski.com"
s.homepage = "http://github.com/NZKoz/rexml-expansion-fix"
rexml-expansion-fix.gemspec
90668758853c543aa5bef57e6405bcb0aaf6be07
Michael Koziarski
michael@koziarski.com
http://github.com/NZKoz/rexml-expansion-fix/commit/784f16ba7de56e243330b846050222fb6d0d44e0
784f16ba7de56e243330b846050222fb6d0d44e0
2008-08-31T09:41:33-07:00
2008-08-31T09:41:33-07:00
Handle a bug which prevented parsing in some circumstances.
If your document had a custom doc-type and your body contained < > " or ' the previous
version would cause a NoMethodError. This is caused by an optimisation in REXML which means those
entities don't have an association to their Document.
dca71953c4cfa33b39080611fc55060eda6fbf63
Michael Koziarski
michael@koziarski.com