mirrors
/
rails
mirror of https://github.com/rails/rails
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

remove rexml security fix for rubies 1.8

This commit is contained in:
Vasiliy Ermolovich 2011-12-26 19:26:37 +03:00
parent 9fffef5f46
commit 2ba1f46000
2 changed files with 0 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
activesupport/lib/active_support/core_ext/rexml.rb
View File

@ -1,46 +0,0 @@
require 'active_support/core_ext/kernel/reporting'
# Fixes the rexml vulnerability disclosed at:
# http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
# This fix is identical to rexml-expansion-fix version 1.0.1.
#
# We still need to distribute this fix because albeit the REXML
# in recent 1.8.7s is patched, it wasn't in early patchlevels.
require 'rexml/rexml'
# Earlier versions of rexml defined REXML::Version, newer ones REXML::VERSION
unless (defined?(REXML::VERSION) ? REXML::VERSION : REXML::Version) > "3.1.7.2"
silence_warnings { require 'rexml/document' }
# REXML in 1.8.7 has the patch but early patchlevels didn't update Version from 3.1.7.2.
unless REXML::Document.respond_to?(:entity_expansion_limit=)
silence_warnings { require 'rexml/entity' }
module REXML #:nodoc:
class Entity < Child #:nodoc:
undef_method :unnormalized
def unnormalized
document.record_entity_expansion! if document
v = value()
return nil if v.nil?
@unnormalized = Text::unnormalize(v, parent)
@unnormalized
end
end
class Document < Element #:nodoc:
@@entity_expansion_limit = 10_000
def self.entity_expansion_limit= val
@@entity_expansion_limit = val
end
def record_entity_expansion!
@number_of_expansions ||= 0
@number_of_expansions += 1
if @number_of_expansions > @@entity_expansion_limit
raise "Number of entity expansions exceeded, processing aborted."
end
end
end
end
end
end

2
activesupport/lib/active_support/ruby/shim.rb
View File

@ -4,7 +4,6 @@
# Date next_year, next_month
# DateTime to_date, to_datetime, xmlschema
# Enumerable group_by, none?
# REXML security fix
# String ord
# Time to_date, to_time, to_datetime
require 'active_support'
@ -14,5 +13,4 @@ require 'active_support/core_ext/enumerable'
require 'active_support/core_ext/string/conversions'
require 'active_support/core_ext/string/interpolation'
require 'active_support/core_ext/string/encoding'
require 'active_support/core_ext/rexml'
require 'active_support/core_ext/time/conversions'