Backport PR3395 for SAX::ParserContex to prevent possible use-after-free

nokogiri-create-full-tarball.sh

@@ -1,17 +1,5 @@
 #!/bin/bash
 
-git_restore_timestamp()
-{
-	set +x
-	echo "Restore timestamps"
-	git ls-tree -r --name-only HEAD | while read f
-	do
-		  unixtime=$(git log -n 1 --pretty='%ct' -- $f)
-		  touch -d "@${unixtime}" $f
-	done
-	set -x
-}
-
 if [ $# -lt 2 ]
 then
   echo "$0 <name> <version>"
@@ -29,14 +17,10 @@ pushd $TMPDIRPATH
 git clone https://github.com/sparklemotion/$1.git
 pushd $1
 git reset --hard v$2
-git_restore_timestamp
 popd
 
 ln -sf $1 $1-$2
-tar czf \
-	${CURRDIR}/rubygem-$1-$2-full.tar.gz \
-	"--exclude=nokogiri-$2/./.git" \
-	$1-$2/./
+tar czf ${CURRDIR}/rubygem-$1-$2-full.tar.gz $1-$2/./
 
 popd
 

rubygem-nokogiri-1.11.0.rc4-shutdown-libxml2-warning.patch

@@ -1,13 +1,10 @@
---- nokogiri-1.18.5/lib/nokogiri/version/info.rb.warn	2023-11-29 01:25:54.000000000 +0900
-+++ nokogiri-1.18.5/lib/nokogiri/version/info.rb	2025-03-26 15:51:51.468291434 +0900
-@@ -70,6 +70,10 @@ module Nokogiri
-     end
+--- nokogiri-1.11.0.rc4/lib/nokogiri/version/info.rb.warn	2020-12-31 16:56:11.533949657 +0900
++++ nokogiri-1.11.0.rc4/lib/nokogiri/version/info.rb	2020-12-31 16:59:38.576697147 +0900
+@@ -58,6 +58,7 @@ module Nokogiri
  
      def warnings
-+        []
-+    end
-+
-+    def warnings_original
        warnings = []
++      return warnings
  
        if libxml2?
+         if compiled_libxml_version != loaded_libxml_version

rubygem-nokogiri-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch

@@ -0,0 +1,73 @@
+From f2a9275e442178084db43505d6425354e016d259 Mon Sep 17 00:00:00 2001
+From: Mike Dalessio <mike.dalessio@gmail.com>
+Date: Sat, 28 Dec 2024 22:21:04 -0500
+Subject: [PATCH] fix: SAX::ParserContext keeps a reference to the input
+
+to prevent it from being GCed before we parse it.
+---
+ ext/nokogiri/xml_sax_parser_context.c | 10 ++++++++--
+ test/test_memory_usage.rb             | 24 ++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+), 2 deletions(-)
+
+diff --git a/ext/nokogiri/xml_sax_parser_context.c b/ext/nokogiri/xml_sax_parser_context.c
+index 75fe2e4f017..0d2b65b599f 100644
+--- a/ext/nokogiri/xml_sax_parser_context.c
++++ b/ext/nokogiri/xml_sax_parser_context.c
+@@ -68,7 +68,10 @@ parse_io(VALUE klass, VALUE io, VALUE encoding)
+     ctxt->sax = NULL;
+   }
+ 
+-  return noko_xml_sax_parser_context_wrap(klass, ctxt);
++  VALUE rb_context = noko_xml_sax_parser_context_wrap(klass, ctxt);
++  rb_iv_set(rb_context, "@input", io);
++
++  return rb_context;
+ }
+ 
+ /*
+@@ -114,7 +117,10 @@ parse_memory(VALUE klass, VALUE data)
+     ctxt->sax = NULL;
+   }
+ 
+-  return noko_xml_sax_parser_context_wrap(klass, ctxt);
++  VALUE rb_context = noko_xml_sax_parser_context_wrap(klass, ctxt);
++  rb_iv_set(rb_context, "@input", data);
++
++  return rb_context;
+ }
+ 
+ static VALUE
+diff --git a/test/test_memory_usage.rb b/test/test_memory_usage.rb
+index a23bb675e07..1b2044b448f 100644
+--- a/test/test_memory_usage.rb
++++ b/test/test_memory_usage.rb
+@@ -311,5 +311,29 @@ class TestMemoryUsage < Nokogiri::TestCase
+         # Expected error. This comment makes rubocop happy.
+       end
+     end
++
++    it "XML::SAX::ParserContext.io holds a reference to IO input" do
++      content = File.read(XML_ATOM_FILE)
++
++      memwatch(__method__) do
++        pc = Nokogiri::XML::SAX::ParserContext.io(StringIO.new(content), "ISO-8859-1")
++        parser = Nokogiri::XML::SAX::Parser.new(Nokogiri::SAX::TestCase::Doc.new)
++        GC.stress
++        pc.parse_with(parser)
++
++        assert_equal(472, parser.document.data.length)
++      end
++    end
++
++    it "XML::SAX::ParserContext.memory holds a reference to string input" do
++      memwatch(__method__) do
++        pc = Nokogiri::XML::SAX::ParserContext.memory(File.read(XML_ATOM_FILE), "ISO-8859-1")
++        parser = Nokogiri::XML::SAX::Parser.new(Nokogiri::SAX::TestCase::Doc.new)
++        GC.stress
++        pc.parse_with(parser)
++
++        assert_equal(472, parser.document.data.length)
++      end
++    end
+   end if ENV["NOKOGIRI_MEMORY_SUITE"] && Nokogiri.uses_libxml?
+ end

rubygem-nokogiri-1.18.10-minitest6.patch

@@ -1,11 +0,0 @@
-diff -urp '--exclude=*~' nokogiri-1.18.10.orig/test/helper.rb nokogiri-1.18.10/test/helper.rb
---- nokogiri-1.18.10.orig/test/helper.rb	2025-12-24 12:29:06.569389292 +0900
-+++ nokogiri-1.18.10/test/helper.rb	2025-12-24 12:39:48.443826371 +0900
-@@ -41,6 +41,7 @@ warn
- 
- require "minitest/autorun"
- require "minitest/benchmark"
-+require "minitest/mock"
- 
- if !Nokogiri.jruby? && ENV["NCPU"].to_i > 1
-   require "minitest/parallel_fork"

rubygem-nokogiri-pr3177-rubyzip-dep-optional.patch

@@ -0,0 +1,31 @@
+From 26e5ba521208706ae68f19062d4ad24ad257aa47 Mon Sep 17 00:00:00 2001
+From: Jun Aruga <jaruga@redhat.com>
+Date: Mon, 15 Apr 2024 15:46:30 +0200
+Subject: [PATCH] Make a test depending on the rubyzip gem optional.
+
+Because I still want to pass the nokogiri's unit tests in a downstream nokogiri
+package on a Linux distro such as CentOS 10 Stream and RHEL 10, where we don't
+want to manage the rubyzip gem[1].
+
+[1] https://rubygems.org/gems/rubyzip
+---
+ test/xml/test_document_encoding.rb | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/test/xml/test_document_encoding.rb b/test/xml/test_document_encoding.rb
+index cd8b1b4da2..c0cb93b283 100644
+--- a/test/xml/test_document_encoding.rb
++++ b/test/xml/test_document_encoding.rb
+@@ -91,7 +91,11 @@ class TestDocumentEncoding < Nokogiri::TestCase
+         describe "pseudo-IO" do
+           it "serializes correctly with Zip::OutputStream objects" do
+             # https://github.com/sparklemotion/nokogiri/issues/2773
+-            require "zip"
++            begin
++              require "zip"
++            rescue LoadError
++              skip("rubyzip is not installed")
++            end
+ 
+             xml = <<~XML
+               <?xml version="1.0" encoding="UTF-8"?>

rubygem-nokogiri.spec

@@ -1,4 +1,4 @@
-%global	mainver		1.19.0
+%global	mainver		1.16.8
 #%%global	prever		.rc4
 
 %global	baserelease		2
@@ -29,12 +29,16 @@ Source1:	rubygem-%{gem_name}-%{version}%{?prever}-full.tar.gz
 Source2:	nokogiri-create-full-tarball.sh
 # Shut down libxml2 version unmatching warning
 Patch0:	%{name}-1.11.0.rc4-shutdown-libxml2-warning.patch
+# https://github.com/sparklemotion/nokogiri/pull/3177
+# Make rubygem-minizip dependency optional
+Patch1:	%{name}-pr3177-rubyzip-dep-optional.patch
+# Backport: https://github.com/sparklemotion/nokogiri/pull/3395
+Patch2:	%{name}-1.16.8-pr3395-sax-parsecontext-keep-referenence.patch
 BuildRequires:	ruby(release)
 BuildRequires:	ruby(rubygems)
 ##
 ## For %%check
 BuildRequires:	rubygem(minitest)
-BuildRequires:	rubygem(minitest-mock)
 %if !0%{?rhel}
 # For test/xml/test_document_encoding.rb
 # Drop rubygem(rubyzip) build dependency in RHEL
@@ -53,6 +57,7 @@ BuildRequires:	libxslt-devel
 BuildRequires:	ruby-devel
 # ruby27 needs this explicitly
 BuildRequires:	rubygem(racc)
+Requires:	rubygem(racc)
 
 %description
 Nokogiri parses and searches XML/HTML very quickly, and also has
@@ -85,6 +90,8 @@ mv ../%{gem_name}-%{version}.gemspec .
 
 # patches
 %patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
 
 # remove bundled external libraries
 sed -i \
@@ -105,7 +112,7 @@ sed -i -e '\@mini_portile@d' %{gem_name}-%{version}.gemspec
 sed -i \
 	ext/nokogiri/extconf.rb \
 	-e "s@^\(def process_recipe.*\)\$@\1 ; return true@" \
-	-e "s@^\([ \t]*append_cppflags\).*gumbo.*\$@\1(\"-I$(pwd)/gumbo-parser/src\")@" \
+	-e "s@^\(append_cppflags\).*gumbo.*\$@\1(\"-I$(pwd)/gumbo-parser/src\")@" \
 	-e "\@libs.*gumbo@s@File\.join.*@\"$(pwd)/gumbo-parser/src/libgumbo.a\"@" \
 	-e "\@LIBPATH.*gumbo@s|^\(.*\)\$|# \1|" \
 	%{nil}
@@ -276,68 +283,8 @@ popd
 %doc	%{gem_dir}/doc/%{gem_name}-%{mainver}%{?prever}/
 
 %changelog
-* Thu Jan 08 2026 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.19.0-2
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_4.0
-
-* Tue Dec 30 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.19.0-1
-- 1.19.0
-
-* Wed Dec 24 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.10-2
-- Handle minitest 6 compatibility
-
-* Mon Sep 15 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.10-1
-- 1.18.10
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.18.9-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Jul 21 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.9-1
-- 1.18.9
-
-* Wed Apr 23 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.8-1
-- 1.18.8
-
-* Mon Apr 07 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.7-1
-- 1.18.7
-
-* Sat Mar 29 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.6-1
-- 1.18.6
-
-* Wed Mar 26 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.5-2
-- Suppress warnings from Nokogiri::VERSION_INFO (bug 2354787)
-
-* Thu Mar 20 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.5-1
-- 1.18.5
-
-* Sun Mar 16 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.4-1
-- 1.18.4
-
-* Wed Feb 19 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.3-1
-- 1.18.3
-
-* Mon Jan 20 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.2-1
-- 1.18.2
-
-* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.18.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Jan 07 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.1-2
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
-
-* Mon Dec 30 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.1-1
-- 1.18.1
-
-* Sat Dec 28 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.18.0-1
-- 1.18.0
-
-* Fri Dec 13 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.17.2-1
-- 1.17.2
-
-* Wed Dec 11 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.17.1-1
-- 1.17.1
-
-* Mon Dec 09 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.17.0-1
-- 1.17.0
+* Mon Dec 30 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.16.8-2
+- Backport PR3395 for SAX::ParserContex to prevent possible use-after-free
 
 * Thu Dec 05 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.16.8-1
 - 1.16.8

sources

@@ -1,2 +1,2 @@
-SHA512 (rubygem-nokogiri-1.19.0-full.tar.gz) = 29dd894b176857d55eb5e670f50e69762e74c0a13e6949030af17e3c84b65f9dfe0087210b84a7c77749d3d1a4a33292d62f7005003745e8f087d822ee64f4b1
-SHA512 (nokogiri-1.19.0.gem) = d9326a2e60b6ea3152c5f9d53df738610f18ca57cffcd3bf2f8b07a2b08b30085d0fce2ca8206279ad6a0f1a613e9e76821c09aef45cf5e5b2d00ff766734872
+SHA512 (nokogiri-1.16.8.gem) = 5dfcdc303dc1a6955f9e3831ca15ea76dad385e10df7d18b2d0b363498206f5fd1b7c24b2849a0199b311e174b8b77c18059b503e6c33e6cae43fffc4d9b0382
+SHA512 (rubygem-nokogiri-1.16.8-full.tar.gz) = 2737ac2b0f0283719803a7471edd3aebc4b3ef230bc22f77de7e764c360d8bf099ab3d807787df1254688cc9cec4727655f86bea508986ca8f5d665f3e32887e