+++ /dev/null
-From eb4f1d6a02e9557b97cdbed76157dc5a625cdb82 Mon Sep 17 00:00:00 2001\r
-From: Aaron Patterson <aaron.patterson@gmail.com>\r
-Date: Tue, 9 Jun 2015 11:24:25 -0700\r
-Subject: [PATCH] enforce a depth limit on XML documents\r
-\r
-XML documents that are too deep can cause an stack overflow, which in\r
-turn will cause a potential DoS attack.\r
-\r
-CVE-2015-3227\r
----\r
- activesupport/lib/active_support/xml_mini.rb | 3 +++\r
- activesupport/lib/active_support/xml_mini/jdom.rb | 11 ++++++-----\r
- activesupport/lib/active_support/xml_mini/rexml.rb | 11 ++++++-----\r
- 3 files changed, 15 insertions(+), 10 deletions(-)\r
-\r
-diff --git a/activesupport/lib/active_support/xml_mini.rb b/activesupport/lib/active_support/xml_mini.rb\r
-index 009ee4d..df7b081 100644\r
---- a/activesupport/lib/active_support/xml_mini.rb\r
-+++ b/activesupport/lib/active_support/xml_mini.rb\r
-@@ -78,6 +78,9 @@ module ActiveSupport\r
- )\r
- end\r
- \r
-+ attr_accessor :depth\r
-+ self.depth = 100\r
-+\r
- delegate :parse, :to => :backend\r
- \r
- def backend\r
-diff --git a/activesupport/lib/active_support/xml_mini/jdom.rb b/activesupport/lib/active_support/xml_mini/jdom.rb\r
-index 27c64c4..cdc5490 100644\r
---- a/activesupport/lib/active_support/xml_mini/jdom.rb\r
-+++ b/activesupport/lib/active_support/xml_mini/jdom.rb\r
-@@ -46,7 +46,7 @@ module ActiveSupport\r
- xml_string_reader = StringReader.new(data)\r
- xml_input_source = InputSource.new(xml_string_reader)\r
- doc = @dbf.new_document_builder.parse(xml_input_source)\r
-- merge_element!({CONTENT_KEY => ''}, doc.document_element)\r
-+ merge_element!({CONTENT_KEY => ''}, doc.document_element, XmlMini.depth)\r
- end\r
- end\r
- \r
-@@ -58,9 +58,10 @@ module ActiveSupport\r
- # Hash to merge the converted element into.\r
- # element::\r
- # XML element to merge into hash\r
-- def merge_element!(hash, element)\r
-+ def merge_element!(hash, element, depth)\r
-+ raise 'Document too deep!' if depth == 0\r
- delete_empty(hash)\r
-- merge!(hash, element.tag_name, collapse(element))\r
-+ merge!(hash, element.tag_name, collapse(element, depth))\r
- end\r
- \r
- def delete_empty(hash)\r
-@@ -71,14 +72,14 @@ module ActiveSupport\r
- #\r
- # element::\r
- # The document element to be collapsed.\r
-- def collapse(element)\r
-+ def collapse(element, depth)\r
- hash = get_attributes(element)\r
- \r
- child_nodes = element.child_nodes\r
- if child_nodes.length > 0\r
- (0...child_nodes.length).each do |i|\r
- child = child_nodes.item(i)\r
-- merge_element!(hash, child) unless child.node_type == Node.TEXT_NODE\r
-+ merge_element!(hash, child, depth - 1) unless child.node_type == Node.TEXT_NODE\r
- end\r
- merge_texts!(hash, element) unless empty_content?(element)\r
- hash\r
-diff --git a/activesupport/lib/active_support/xml_mini/rexml.rb b/activesupport/lib/active_support/xml_mini/rexml.rb\r
-index 5c7c78b..924ed72 100644\r
---- a/activesupport/lib/active_support/xml_mini/rexml.rb\r
-+++ b/activesupport/lib/active_support/xml_mini/rexml.rb\r
-@@ -29,7 +29,7 @@ module ActiveSupport\r
- doc = REXML::Document.new(data)\r
- \r
- if doc.root\r
-- merge_element!({}, doc.root)\r
-+ merge_element!({}, doc.root, XmlMini.depth)\r
- else\r
- raise REXML::ParseException,\r
- "The document #{doc.to_s.inspect} does not have a valid root"\r
-@@ -44,19 +44,20 @@ module ActiveSupport\r
- # Hash to merge the converted element into.\r
- # element::\r
- # XML element to merge into hash\r
-- def merge_element!(hash, element)\r
-- merge!(hash, element.name, collapse(element))\r
-+ def merge_element!(hash, element, depth)\r
-+ raise REXML::ParseException, "The document is too deep" if depth == 0\r
-+ merge!(hash, element.name, collapse(element, depth))\r
- end\r
- \r
- # Actually converts an XML document element into a data structure.\r
- #\r
- # element::\r
- # The document element to be collapsed.\r
-- def collapse(element)\r
-+ def collapse(element, depth)\r
- hash = get_attributes(element)\r
- \r
- if element.has_elements?\r
-- element.each_element {|child| merge_element!(hash, child) }\r
-+ element.each_element {|child| merge_element!(hash, child, depth - 1) }\r
- merge_texts!(hash, element) unless empty_content?(element)\r
- hash\r
- else\r
--- \r
-2.2.1\r
-\r
-\r
\ No newline at end of file