Skip to content

Commit

Permalink
Fix a bug that invalid element end may be accepted
Browse files Browse the repository at this point in the history
HackerOne: HO-1104077

It's caused by ignoring garbage before "\n</NAME>".

Reported by Juho Nurminen. Thanks!!!
  • Loading branch information
kou authored and mame committed Apr 5, 2021
1 parent 6a250d2 commit f7bab89
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 1 deletion.
2 changes: 1 addition & 1 deletion lib/rexml/parsers/baseparser.rb
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ class BaseParser
INSTRUCTION_START = /\A<\?/u
INSTRUCTION_PATTERN = /<\?#{NAME}(\s+.*?)?\?>/um
TAG_MATCH = /\A<((?>#{QNAME_STR}))/um
CLOSE_MATCH = /^\s*<\/(#{QNAME_STR})\s*>/um
CLOSE_MATCH = /\A\s*<\/(#{QNAME_STR})\s*>/um

VERSION = /\bversion\s*=\s*["'](.*?)['"]/um
ENCODING = /\bencoding\s*=\s*["'](.*?)['"]/um
Expand Down
13 changes: 13 additions & 0 deletions test/parse/test_element.rb
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,19 @@ def test_garbage_less_than_before_root_element_at_line_start
< <x/>
DETAIL
end

def test_garbage_less_than_slash_before_end_tag_at_line_start
exception = assert_raise(REXML::ParseException) do
parse("<x></\n</x>")
end
assert_equal(<<-DETAIL.chomp, exception.to_s)
Missing end tag for 'x'
Line: 2
Position: 10
Last 80 unconsumed characters:
</ </x>
DETAIL
end
end
end
end

0 comments on commit f7bab89

Please sign in to comment.