Merge branch '693-nonet'

CHANGELOG.ja.rdoc

@@ -10,6 +10,9 @@
 
   * Segmentation fault when creating a comment node for a DocumentFragment. #677, #678.
   * Treat '.' as xpath in at() and search(). #690
+  * [MRI] [Security] Default parse options for XML documents were
+    changed to not make network connections during document parsing,
+    to avoid XXE vulnerability. #693
 
 
 == 1.5.3 / 2012-06-01

CHANGELOG.rdoc

@@ -10,7 +10,9 @@
 
   * Segmentation fault when creating a comment node for a DocumentFragment. #677, #678.
   * Treat '.' as xpath in at() and search(). #690
-
+  * [MRI] [Security] Default parse options for XML documents were
+    changed to not make network connections during document parsing,
+    to avoid XXE vulnerability. #693
 
 == 1.5.3 / 2012-06-01
 

lib/nokogiri/xml/parse_options.rb

@@ -47,7 +47,7 @@ class ParseOptions
       HUGE        = 1 << 19
 
       # the default options used for parsing XML documents
-      DEFAULT_XML  = RECOVER
+      DEFAULT_XML  = RECOVER | NONET
       # the default options used for parsing HTML documents
       DEFAULT_HTML = RECOVER | NOERROR | NOWARNING | NONET
 
@@ -64,6 +64,11 @@ def #{constant.downcase}
             self
           end
 
+          def no#{constant.downcase}
+            @options &= ~#{constant}
+            self
+          end
+
           def #{constant.downcase}?
             #{constant} & @options == #{constant}
           end

test/xml/test_parse_options.rb

@@ -35,6 +35,18 @@ def test_new_with_argument
         assert_equal 1 << 1, options.options
       end
 
+      def test_unsetting
+        options = Nokogiri::XML::ParseOptions.new Nokogiri::XML::ParseOptions::DEFAULT_HTML
+        assert options.nonet?
+        assert options.recover?
+        options.nononet.norecover
+        assert ! options.nonet?
+        assert ! options.recover?
+        options.nonet.recover
+        assert options.nonet?
+        assert options.recover?
+      end
+
       def test_chaining
         options = Nokogiri::XML::ParseOptions.new.recover.noent
         assert options.recover?