From 2ba1f460008536c4d7a9fa1fba623a53e1b8aed1 Mon Sep 17 00:00:00 2001
From: Vasiliy Ermolovich <younash@gmail.com>
Date: Mon, 26 Dec 2011 19:26:37 +0300
Subject: [PATCH] remove rexml security fix for rubies 1.8

---
 .../lib/active_support/core_ext/rexml.rb      | 46 -------------------
 activesupport/lib/active_support/ruby/shim.rb |  2 -
 2 files changed, 48 deletions(-)
 delete mode 100644 activesupport/lib/active_support/core_ext/rexml.rb

diff --git a/activesupport/lib/active_support/core_ext/rexml.rb b/activesupport/lib/active_support/core_ext/rexml.rb
deleted file mode 100644
index 0419ebc84b..0000000000
--- a/activesupport/lib/active_support/core_ext/rexml.rb
+++ /dev/null
@@ -1,46 +0,0 @@
-require 'active_support/core_ext/kernel/reporting'
-
-# Fixes the rexml vulnerability disclosed at:
-# http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
-# This fix is identical to rexml-expansion-fix version 1.0.1.
-#
-# We still need to distribute this fix because albeit the REXML
-# in recent 1.8.7s is patched, it wasn't in early patchlevels.
-require 'rexml/rexml'
-
-# Earlier versions of rexml defined REXML::Version, newer ones REXML::VERSION
-unless (defined?(REXML::VERSION) ? REXML::VERSION : REXML::Version) > "3.1.7.2"
-  silence_warnings { require 'rexml/document' }
-
-  # REXML in 1.8.7 has the patch but early patchlevels didn't update Version from 3.1.7.2.
-  unless REXML::Document.respond_to?(:entity_expansion_limit=)
-    silence_warnings { require 'rexml/entity' }
-
-    module REXML #:nodoc:
-      class Entity < Child #:nodoc:
-        undef_method :unnormalized
-        def unnormalized
-          document.record_entity_expansion! if document
-          v = value()
-          return nil if v.nil?
-          @unnormalized = Text::unnormalize(v, parent)
-          @unnormalized
-        end
-      end
-      class Document < Element #:nodoc:
-        @@entity_expansion_limit = 10_000
-        def self.entity_expansion_limit= val
-          @@entity_expansion_limit = val
-        end
-
-        def record_entity_expansion!
-          @number_of_expansions ||= 0
-          @number_of_expansions += 1
-          if @number_of_expansions > @@entity_expansion_limit
-            raise "Number of entity expansions exceeded, processing aborted."
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/activesupport/lib/active_support/ruby/shim.rb b/activesupport/lib/active_support/ruby/shim.rb
index 9652eb4028..41fd866481 100644
--- a/activesupport/lib/active_support/ruby/shim.rb
+++ b/activesupport/lib/active_support/ruby/shim.rb
@@ -4,7 +4,6 @@
 # Date        next_year, next_month
 # DateTime    to_date, to_datetime, xmlschema
 # Enumerable  group_by, none?
-# REXML       security fix
 # String      ord
 # Time        to_date, to_time, to_datetime
 require 'active_support'
@@ -14,5 +13,4 @@
 require 'active_support/core_ext/string/conversions'
 require 'active_support/core_ext/string/interpolation'
 require 'active_support/core_ext/string/encoding'
-require 'active_support/core_ext/rexml'
 require 'active_support/core_ext/time/conversions'
-- 
GitLab