Skip to content
Browse files

* lib/rexml/security.rb (REXML::Security): create.

* lib/rexml/rexml.rb: move entity_expansion_limit and
  entity_expansion_text_limit accessors to ...
* lib/rexml/security.rb: ... here.
* lib/rexml/document.rb: use REXML::Security.
* lib/rexml/text.rb: use REXML::Security.
* test/rexml/test_document.rb: use REXML::Security.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@39528 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
  • Loading branch information...
1 parent 20514a0 commit 3b6d093451565c80d36c791ff6ac9cbc5918d287 @kou kou committed
Showing with 54 additions and 40 deletions.
  1. +10 −0 ChangeLog
  2. +10 −9 lib/rexml/document.rb
  3. +0 −24 lib/rexml/rexml.rb
  4. +27 −0 lib/rexml/security.rb
  5. +2 −2 lib/rexml/text.rb
  6. +5 −5 test/rexml/test_document.rb
View
10 ChangeLog
@@ -1,3 +1,13 @@
+Wed Feb 27 21:14:34 2013 Kouhei Sutou <kou@cozmixng.org>
+
+ * lib/rexml/security.rb (REXML::Security): create.
+ * lib/rexml/rexml.rb: move entity_expansion_limit and
+ entity_expansion_text_limit accessors to ...
+ * lib/rexml/security.rb: ... here.
+ * lib/rexml/document.rb: use REXML::Security.
+ * lib/rexml/text.rb: use REXML::Security.
+ * test/rexml/test_document.rb: use REXML::Security.
+
Wed Feb 27 19:53:32 2013 Benoit Daloze <eregontp@gmail.com>
* vm.c (Thread): fix typos in overview
View
19 lib/rexml/document.rb
@@ -1,3 +1,4 @@
+require "rexml/security"
require "rexml/element"
require "rexml/xmldecl"
require "rexml/source"
@@ -245,37 +246,37 @@ def Document::parse_stream( source, listener )
# Set the entity expansion limit. By default the limit is set to 10000.
#
- # Deprecated. Use REXML.entity_expansion_limit= instead.
+ # Deprecated. Use REXML::Security.entity_expansion_limit= instead.
def Document::entity_expansion_limit=( val )
- REXML.entity_expansion_limit = val
+ Security.entity_expansion_limit = val
end
# Get the entity expansion limit. By default the limit is set to 10000.
#
- # Deprecated. Use REXML.entity_expansion_limit= instead.
+ # Deprecated. Use REXML::Security.entity_expansion_limit= instead.
def Document::entity_expansion_limit
- return REXML.entity_expansion_limit
+ return Security.entity_expansion_limit
end
# Set the entity expansion limit. By default the limit is set to 10240.
#
- # Deprecated. Use REXML.entity_expansion_text_limit= instead.
+ # Deprecated. Use REXML::Security.entity_expansion_text_limit= instead.
def Document::entity_expansion_text_limit=( val )
- REXML.entity_expansion_text_limit = val
+ Security.entity_expansion_text_limit = val
end
# Get the entity expansion limit. By default the limit is set to 10240.
#
- # Deprecated. Use REXML.entity_expansion_text_limit instead.
+ # Deprecated. Use REXML::Security.entity_expansion_text_limit instead.
def Document::entity_expansion_text_limit
- return REXML.entity_expansion_text_limit
+ return Security.entity_expansion_text_limit
end
attr_reader :entity_expansion_count
def record_entity_expansion
@entity_expansion_count += 1
- if @entity_expansion_count > REXML.entity_expansion_limit
+ if @entity_expansion_count > Security.entity_expansion_limit
raise "number of entity expansions exceeded, processing aborted."
end
end
View
24 lib/rexml/rexml.rb
@@ -28,28 +28,4 @@ module REXML
Copyright = COPYRIGHT
Version = VERSION
-
- @@entity_expansion_limit = 10_000
-
- # Set the entity expansion limit. By default the limit is set to 10000.
- def self.entity_expansion_limit=( val )
- @@entity_expansion_limit = val
- end
-
- # Get the entity expansion limit. By default the limit is set to 10000.
- def self.entity_expansion_limit
- return @@entity_expansion_limit
- end
-
- @@entity_expansion_text_limit = 10_240
-
- # Set the entity expansion limit. By default the limit is set to 10240.
- def self.entity_expansion_text_limit=( val )
- @@entity_expansion_text_limit = val
- end
-
- # Get the entity expansion limit. By default the limit is set to 10240.
- def self.entity_expansion_text_limit
- return @@entity_expansion_text_limit
- end
end
View
27 lib/rexml/security.rb
@@ -0,0 +1,27 @@
+module REXML
+ module Security
+ @@entity_expansion_limit = 10_000
+
+ # Set the entity expansion limit. By default the limit is set to 10000.
+ def self.entity_expansion_limit=( val )
+ @@entity_expansion_limit = val
+ end
+
+ # Get the entity expansion limit. By default the limit is set to 10000.
+ def self.entity_expansion_limit
+ return @@entity_expansion_limit
+ end
+
+ @@entity_expansion_text_limit = 10_240
+
+ # Set the entity expansion limit. By default the limit is set to 10240.
+ def self.entity_expansion_text_limit=( val )
+ @@entity_expansion_text_limit = val
+ end
+
+ # Get the entity expansion limit. By default the limit is set to 10240.
+ def self.entity_expansion_text_limit
+ return @@entity_expansion_text_limit
+ end
+ end
+end
View
4 lib/rexml/text.rb
@@ -1,4 +1,4 @@
-require 'rexml/rexml'
+require 'rexml/security'
require 'rexml/entity'
require 'rexml/doctype'
require 'rexml/child'
@@ -384,7 +384,7 @@ def Text::unnormalize( string, doctype=nil, filter=nil, illegal=nil )
sum = 0
string.gsub( /\r\n?/, "\n" ).gsub( REFERENCE ) {
s = Text.expand($&, doctype, filter)
- if sum + s.bytesize > REXML.entity_expansion_text_limit
+ if sum + s.bytesize > Security.entity_expansion_text_limit
raise "entity expansion has grown too large"
else
sum += s.bytesize
View
10 test/rexml/test_document.rb
@@ -65,24 +65,24 @@ def test_entity_expansion_limit
assert_raise(RuntimeError) do
doc.root.children.first.value
end
- REXML::Document.entity_expansion_limit = 100
- assert_equal(100, REXML::Document.entity_expansion_limit)
+ REXML::Security.entity_expansion_limit = 100
+ assert_equal(100, REXML::Security.entity_expansion_limit)
doc = REXML::Document.new(XML_WITH_NESTED_ENTITY)
assert_raise(RuntimeError) do
doc.root.children.first.value
end
assert_equal(101, doc.entity_expansion_count)
- REXML::Document.entity_expansion_limit = 4
+ REXML::Security.entity_expansion_limit = 4
doc = REXML::Document.new(XML_WITH_4_ENTITY_EXPANSION)
assert_equal("\na\na a\n<\n", doc.root.children.first.value)
- REXML::Document.entity_expansion_limit = 3
+ REXML::Security.entity_expansion_limit = 3
doc = REXML::Document.new(XML_WITH_4_ENTITY_EXPANSION)
assert_raise(RuntimeError) do
doc.root.children.first.value
end
ensure
- REXML::Document.entity_expansion_limit = 10000
+ REXML::Security.entity_expansion_limit = 10000
end
def test_tag_in_cdata_with_not_ascii_only_but_ascii8bit_encoding_source

0 comments on commit 3b6d093

Please sign in to comment.
Something went wrong with that request. Please try again.