This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.
After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.
Let us know if you have any questions. Thanks so much for giving Depfu a try!
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.
Make net-ftp an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called and net-ftp isn't available; this should only happen in Ruby 3.1 and later.
Add net-ftp as an explicit dependency to accommodate the upcoming Ruby 3.1 changes that move this and other gems out of the "default" gem set and into the "bundled" gem set. See https://bugs.ruby-lang.org/issues/17873 [#101]
MiniPortile.execute now takes an optional :env hash, which is merged into the environment variables for the subprocess. Likely this is only useful for specialized use cases. [#99]
Experimental support for cmake-based projects extended to Windows. (Thanks, @larskanis!)
Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via xmllint is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992).
Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.
Mitigation
Upgrade to Nokogiri >= 1.11.4.
Impact
I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.
All information below is sourced from security.archlinux.org, which appears to have the most up-to-date information as of this analysis.
Description: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.
Description: A use-after-free security issue was found in libxml2 before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when processing crafted files.
Description: It was found that libxml2 before version 2.9.11 did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application.
Description: A security issue was found in libxml2 before version 2.9.11. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into DTDLOAD which is off by default).
For more details supporting this analysis of this CVE, please visit #2233.
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.
This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.
Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".
Affected Versions
Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3
Mitigation
There are no known workarounds for affected versions. Upgrade to Nokogiri 1.11.0.rc4 or later.
If, after upgrading to 1.11.0.rc4 or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):
Ensure the input is trusted. Do not enable this option
for untrusted input.
When invoking the Nokogiri::XML::Schema constructor,
pass as the second parameter an instance of Nokogiri::XML::ParseOptions with the NONET flag turned off.
So if your previous code was:
# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network# but in v1.11.0.rc4 and later, this call will disallow network access for external resourcesschema=Nokogiri::XML::Schema.new(schema)# in v1.11.0.rc4 and later, the following is equivalent to the code above# (the second parameter is optional, and this demonstrates its default value)schema=Nokogiri::XML::Schema.new(schema,Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
Then you can add the second parameter to indicate that the input is trusted by changing it to:
# in v1.11.0.rc3 and earlier, this would raise an ArgumentError# but in v1.11.0.rc4 and later, this allows resources to be accessed over the networkschema=Nokogiri::XML::Schema.new(trusted_schema,Nokogiri::XML::ParseOptions.new.nononet)
Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.
This is a security release. It addresses three CVEs in upstream libxml2,
for which details are below.
If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
these vulnerabilities.
Full details about the security update are available in Github Issue
[#1943] #1943.
Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
could allow an attacker to discern whether a byte on the stack contains the
characters A, a, I, i, or 0, or any other character.
Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
xsl:number instruction was too narrow and an invalid character/length
combination could be passed to xsltNumberFormatDecimal, leading to a read
of uninitialized stack data
Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
reset under certain circumstances. If the relevant memory area happened to
be freed and reused in a certain way, a bounds check could fail and memory
outside a buffer could be written to, or uninitialized data could be
disclosed.
This is a security release. It addresses a CVE in upstream libxslt rated as
"Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More
details are available below.
If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time, though
you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that this patch is not yet (as
of 2019-04-22) in an upstream release of libxslt.
Full details about the security update are available in Github Issue
[#1892] #1892.
libxslt through 1.1.33 allows bypass of a protection mechanism
because callers of xsltCheckRead and xsltCheckWrite permit access
even upon receiving a -1 error code. xsltCheckRead can return -1 for
a crafted URL that is not actually invalid and is subsequently
loaded.
Canonical rates this as "Priority: Medium".
Debian rates this as "NVD Severity: High (attack range: remote)".
This is a security and bugfix release. It addresses two CVEs in upstream
libxml2 rated as "medium" by Red Hat, for which details are below.
If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that these patches are not
yet (as of 2018-10-04) in an upstream release of libxml2.
Full details about the security update are available in Github Issue #1785.
[#1785]: #1785
[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
and CVE-2018-14567. Full details are available in #1785. Note that these
patches are not yet (as of 2018-10-04) in an upstream release of libxml2.
A NULL pointer dereference vulnerability exists in the
xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
case. Applications processing untrusted XSL format inputs with the use of
the libxml2 library may be vulnerable to a denial of service attack due
to a crash of the application
Canonical rates this vulnerability as "Priority: Medium"
[MRI] Behavior in libxml2 has been reverted which caused
CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and
CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is
here:
The update of vendored libxml2 from 2.9.5 to 2.9.7 addresses at least one published vulnerability, CVE-2017-15412. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to upgrade at this time.
Details: It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.
The version of libxml2 packaged with Nokogiri contains a
vulnerability. Nokogiri has mitigated these issue by upgrading to
libxml 2.9.5.
Wei Lei discovered that libxml2 incorrecty handled certain parameter
entities. An attacker could use this issue with specially constructed XML
data to cause libxml2 to consume resources, leading to a denial of service.
The version of libxml2 packaged with Nokogiri contains several vulnerabilities.
Nokogiri has mitigated these issues by upgrading to libxml 2.9.5.
It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)
It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)
It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)
Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)
Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)
Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)
You don't seem to have any Continuous Integration service set up!
Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the
service we're trying to provide down to a point where it is more or less meaningless.
This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:
* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Travis-CI](https://travis-ci.com) are all excellent options.
* If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
* If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
Welcome to Depfu 👋
This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.
After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.
Let us know if you have any questions. Thanks so much for giving Depfu a try!
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
↗️ loofah (indirect, 2.0.3 → 2.10.0) · Repo · Changelog
Security Advisories 🚨
🚨 Loofah XSS Vulnerability
🚨 Loofah XSS Vulnerability
🚨 Loofah XSS Vulnerability
Release Notes
2.10.0
2.9.1
2.9.0
2.8.0
2.7.0
2.6.0 (from changelog)
2.5.0 (from changelog)
2.4.0
2.3.1
2.3.0 (from changelog)
2.2.3
2.2.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ mini_portile2 (indirect, 2.2.0 → 2.5.3) · Repo · Changelog
Release Notes
2.5.3
2.5.2
2.5.1
2.5.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 69 commits:
version bump to v2.5.3Merge pull request #106 from flavorjones/105-address-net-ftp-warningsdep: make net-ftp an optional dependencychore: remove ruby warning about unused variableversion bump to v2.5.2Merge pull request #103 from flavorjones/flavorjones-ci-add-2.3-and-2.4-to-the-matrixci: add 2.3 and 2.4 to the matrixMerge pull request #102 from flavorjones/101-add-ruby-head-to-cifix: make net-ftp dependency explicit, for Ruby 3.1 compatibilityci: add ruby-head to the test matrixversion bump to v2.5.1fix: #execute should always emit "OK" on successMerge pull request #100 from flavorjones/flavorjones-execute-takes-env-optionfeat: #execute now accepts an optional :env hashremove remaining traces of concoursedoc: update README with Actions status badgeMerge pull request #98 from flavorjones/flavorjones-migrate-to-github-actionsci: remove appveyor and concourse configsci: set makeflags to parallelize buildsci: skip sqlite and ares examples on windowsci: update sqlite version in examples testci: separate out test:examples from test:unitci: config git so that newlines don't break gpg sigsci: add windows coverage to GA CItest: omit options with spaces from the cmake testdep: add webrick as a dev dep for Ruby 3.0ci: linux CI on GAupdate default branch from master to mainMerge pull request #95 from amatsuda/httpsGitHub is HTTPS by defaultMerge pull request #94 from larskanis/appveyorupdate CHANGELOGci: rename pipelines to avoid concourse warningsci: rename pipelines to avoid concourse warningsFix cmake usage and related tests on WindowsUpdate Appveyor-CI to newer rubiesAdjust version dependenciesci: upgrade to teliaoss/github-pr-resourceci: remove .travis.ymlREADME: update badges: travis→concourse, tideliftREADME: add Support section with CTA for TideliftCreate FUNDING.ymlpublishing a security reporting processversion bump to v2.5.0update CHANGELOGci: ensure bundler is up-to-dateci: ensure bundler is up-to-dateci: update concourse, split pipelines into master and prrakefile: rufo formattinggemspec: update dev dep for bundlergemspec: rufo formattingMerge pull request #90 from hanazuki/multiple-pubkeysRemove all the imported pubkeys from keyringversion bump to v2.4.0update CHANGELOG in preparation for v2.4.0update dev dependenciesMerge pull request #86 from eagletmt/skip-progress-when-chunkedMerge pull request #87 from halfbyte/patch-1Make version in changelog fit release version.Skip progress report when Content-Length is unavailableupdate test:examples to libiconv 1.15concourse: test most-recent two rubiesconvert to using windows-ruby-dev-tools-releaseversion bump to 2.3.0update CHANGELOGMerge pull request #82 from larskanis/better-error-if-tar-is-missingRaise a suitable error message, if tar can't be foundupdate changelogre-verify files at extract time↗️ nokogiri (indirect, 1.8.0 → 1.11.7) · Repo · Changelog
Security Advisories 🚨
🚨 Update packaged dependency libxml2 from 2.9.10 to 2.9.12
🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
🚨 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
🚨 Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
🚨 Nokogiri Command Injection Vulnerability
🚨 Nokogiri gem, via libxslt, is affected by improper access control vulnerability
🚨 Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
🚨 Revert libxml2 behavior in Nokogiri gem that could cause XSS
🚨 libxml2 could be made to crash or run arbitrary code if it opened a specially crafted file
🚨 Nokogiri gem, via libxml, is affected by DoS vulnerabilities
🚨 Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 crass (added, 1.0.6)
🆕 racc (added, 1.5.2)
👉 No CI detected
You don't seem to have any Continuous Integration service set up!
Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.
This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:
* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Travis-CI](https://travis-ci.com) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands