Regression: REXML DoS fix causes error when parsing XML

[Makoto Kato]

Binary package hint: ruby1.8

REXML in Ubuntu 8.10 causes unexpected error. When I use REXML in 8.04 original, this doesn't occurs.

This is reported Debian BTS (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502535). Fix patch is attached in that BTS bugs.

- Env.
Package: libruby1.8
Status: install ok installed
Priority: optional
Section: libs
Installed-Size: 6136
Maintainer: Ubuntu Core Developers <email address hidden>
Architecture: amd64
Source: ruby1.8
Version: 1.8.7.72-1

- Step
$ ruby -r rexml/document -r open-uri -e 'REXML::Document.new(URI.parse("http://github.com/bioruby/bioruby/tree/master%2Ftest%2Fdata%2Fblast%2Fb0002.faa.m7?raw=true").read).root.each_element_with_text { |e| p e.name }'

"BlastOutput_program"
"BlastOutput_version"
/usr/lib/ruby/1.8/rexml/entity.rb:76:in `unnormalized': undefined method `record_entity_expansion' for nil:NilClass (NoMethodError)
 from /usr/lib/ruby/1.8/rexml/doctype.rb:135:in `entity'
 from /usr/lib/ruby/1.8/rexml/text.rb:325:in `unnormalize'
 from /usr/lib/ruby/1.8/rexml/text.rb:323:in `each'
 from /usr/lib/ruby/1.8/rexml/text.rb:323:in `unnormalize'
 from /usr/lib/ruby/1.8/rexml/text.rb:174:in `value'
 from /usr/lib/ruby/1.8/rexml/element.rb:452:in `text'
 from /usr/lib/ruby/1.8/rexml/element.rb:433:in `has_text?'
 from /usr/lib/ruby/1.8/rexml/element.rb:384:in `each_element_with_text'
 from /usr/lib/ruby/1.8/rexml/element.rb:710:in `call'
 from /usr/lib/ruby/1.8/rexml/element.rb:710:in `each_with_something'
 from /usr/lib/ruby/1.8/rexml/element.rb:892:in `each'
 from /usr/lib/ruby/1.8/rexml/xpath.rb:53:in `each'
 from /usr/lib/ruby/1.8/rexml/element.rb:892:in `each'
 from /usr/lib/ruby/1.8/rexml/element.rb:709:in `each_with_something'
 from /usr/lib/ruby/1.8/rexml/element.rb:388:in `each_element_with_text'
 from -e:1

[Ben J Woodcroft (donttrustben)]

I can confirm this as well.

[Alex Tomlins (alex-tomlins)]

I can confirm that this is also happening in 8.04 now.

libruby1.8 version 1.8.6.111-2ubuntu1.2

Applying the patch mentioned in the Debian bug report to /usr/lib/ruby/1.8/rexml/entity.rb fixes the problem.

Alex