Nokogiri v1.12.5 Release NotesRelease Date: 2021-09-27 // 28 days ago
🔒 [JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).
0️⃣ In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.
💎 CRuby users are not affected by this CVE.
- 💎 [CRuby]
Document#to_xhtmlproperly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g.,
<br></br>) instead of a self-closing tag (e.g.,
<br/>) in previous Nokogiri versions. [#2324]
- 💎 [CRuby]
Previous changes from v1.12.4
Notable fix: Namespace inheritance
💎 Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.
🚀 This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.
Compensating Feature in XML::Document
🚀 This release of Nokogiri introduces a new
namespace_inheritance, which controls whether children should inherit a namespace when they are reparented.
Nokogiri::XML:Documentdefaults this attribute to
falsemeaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.
💎 CRuby users who desire the pre-v1.12.0 behavior may set
document.namespace_inheritance = truebefore reparenting nodes.
See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.
🛠 Fix for XML::Builder
🏗 However, recognizing that we want
Builder-created children to inherit namespaces, Builder now will set
namespace_inheritance=trueon the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored.
🏗 Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so:
🏗 See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage.
Downstream gem maintainers
Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance:
Gem::Specification.new do |gem| # ... gem.add_runtime_dependency 'nokogiri', '!=1.12.3', '!=1.12.2', '!=1.12.1', '!=1.12.0' # ... end