!231 fix CVE-2021-41817

From: @tong_1001 Reviewed-by: @shinwell_hu, @shenyangyang01 Signed-off-by: @shenyangyang01
fix CVE-2021-41817
2024-12-23 09:07:28 +00:00 · 2024-12-19 17:07:07 +08:00 · 2024-10-30 10:04:02 +00:00 · 2024-10-29 19:39:08 +08:00 · 2024-10-08 10:05:10 +00:00 · 2024-10-08 14:25:33 +08:00
8 changed files with 2129 additions and 2 deletions
--- a/backport-0001-CVE-2021-41817.patch
+++ b/backport-0001-CVE-2021-41817.patch
@ -0,0 +1,911 @@
 From 489c8cebf575741d62effd0d212f1319beff3c40 Mon Sep 17 00:00:00 2001
 From: Yusuke Endoh <mame@ruby-lang.org>
 Date: Fri, 12 Nov 2021 12:15:25 +0900
 Subject: [PATCH] [ruby/date] Add length limit option for methods that parses
 date strings
 `Date.parse` now raises an ArgumentError when a given date string is
 longer than 128. You can configure the limit by giving `limit` keyword
 arguments like `Date.parse(str, limit:1000)`. If you pass `limit:nil`,
 the limit is disabled.
 Not only `Date.parse` but also the following methods are changed.
 * Date._parse
 * Date.parse
 * DateTime.parse
 * Date._iso8601
 * Date.iso8601
 * DateTime.iso8601
 * Date._rfc3339
 * Date.rfc3339
 * DateTime.rfc3339
 * Date._xmlschema
 * Date.xmlschema
 * DateTime.xmlschema
 * Date._rfc2822
 * Date.rfc2822
 * DateTime.rfc2822
 * Date._rfc822
 * Date.rfc822
 * DateTime.rfc822
 * Date._jisx0301
 * Date.jisx0301
 * DateTime.jisx0301
 https://github.com/ruby/date/commit/3959accef8
 ---
 ext/date/date_core.c         | 384 +++++++++++++++++++++++++++--------
 test/date/test_date_parse.rb |  29 +++
 2 files changed, 325 insertions(+), 88 deletions(-)
 diff --git a/ext/date/date_core.c b/ext/date/date_core.c
 index c250633..177ea0f 100644
 --- a/ext/date/date_core.c
 +++ b/ext/date/date_core.c
@@ -4290,12 +4290,37 @@ date_s_strptime(int argc, VALUE *argv, VALUE klass)
 VALUE date__parse(VALUE str, VALUE comp);
 +static size_t
 +get_limit(VALUE opt)
 +{
 +    if (!NIL_P(opt)) {
 +        VALUE limit = rb_hash_aref(opt, ID2SYM(rb_intern("limit")));
 +        if (NIL_P(limit)) return SIZE_MAX;
 +        return NUM2SIZET(limit);
 +    }
 +    return 128;
 +}
 +
 +static void
 +check_limit(VALUE str, VALUE opt)
 +{
 +    StringValue(str);
 +    size_t slen = RSTRING_LEN(str);
 +    size_t limit = get_limit(opt);
 +    if (slen > limit) {
 +	rb_raise(rb_eArgError,
 +		 "string length (%"PRI_SIZE_PREFIX"u) exceeds the limit %"PRI_SIZE_PREFIX"u", slen, limit);
 +    }
 +}
 +
 static VALUE
 date_s__parse_internal(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE vstr, vcomp, hash;
 +    VALUE vstr, vcomp, hash, opt;
 -    rb_scan_args(argc, argv, "11", &vstr, &vcomp);
 +    rb_scan_args(argc, argv, "11:", &vstr, &vcomp, &opt);
 +    if (!NIL_P(opt)) argc--;
 +    check_limit(vstr, opt);
     StringValue(vstr);
     if (!rb_enc_str_asciicompat_p(vstr))
 	rb_raise(rb_eArgError,
@@ -4320,7 +4345,7 @@ date_s__parse_internal(int argc, VALUE *argv, VALUE klass)
 /*
  * call-seq:
 - *    Date._parse(string[, comp=true])  ->  hash
 + *    Date._parse(string[, comp=true], limit: 128)  ->  hash
  *
  * Parses the given representation of date and time, and returns a
  * hash of parsed elements.  This method does not function as a
@@ -4331,6 +4356,10 @@ date_s__parse_internal(int argc, VALUE *argv, VALUE klass)
  * it full.
  *
  *    Date._parse('2001-02-03')	#=> {:year=>2001, :mon=>2, :mday=>3}
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s__parse(int argc, VALUE *argv, VALUE klass)
@@ -4340,7 +4369,7 @@ date_s__parse(int argc, VALUE *argv, VALUE klass)
 /*
  * call-seq:
 - *    Date.parse(string='-4712-01-01'[, comp=true[, start=Date::ITALY]])  ->  date
 + *    Date.parse(string='-4712-01-01'[, comp=true[, start=Date::ITALY]], limit: 128)  ->  date
  *
  * Parses the given representation of date and time, and creates a
  * date object.  This method does not function as a validator.
@@ -4352,13 +4381,18 @@ date_s__parse(int argc, VALUE *argv, VALUE klass)
  *    Date.parse('2001-02-03')		#=> #<Date: 2001-02-03 ...>
  *    Date.parse('20010203')		#=> #<Date: 2001-02-03 ...>
  *    Date.parse('3rd Feb 2001')	#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_parse(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, comp, sg;
 +    VALUE str, comp, sg, opt;
 -    rb_scan_args(argc, argv, "03", &str, &comp, &sg);
 +    rb_scan_args(argc, argv, "03:", &str, &comp, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -4370,11 +4404,12 @@ date_s_parse(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE argv2[2], hash;
 -
 -	argv2[0] = str;
 -	argv2[1] = comp;
 -	hash = date_s__parse(2, argv2, klass);
 +        int argc2 = 2;
 +	VALUE argv2[3];
 +        argv2[0] = str;
 +        argv2[1] = comp;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__parse(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
@@ -4388,19 +4423,28 @@ VALUE date__jisx0301(VALUE);
 /*
  * call-seq:
 - *    Date._iso8601(string)  ->  hash
 + *    Date._iso8601(string, limit: 128)  ->  hash
  *
  * Returns a hash of parsed elements.
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 -date_s__iso8601(VALUE klass, VALUE str)
 +date_s__iso8601(int argc, VALUE *argv, VALUE klass)
 {
 +    VALUE str, opt;
 +
 +    rb_scan_args(argc, argv, "1:", &str, &opt);
 +    check_limit(str, opt);
 +
     return date__iso8601(str);
 }
 /*
  * call-seq:
 - *    Date.iso8601(string='-4712-01-01'[, start=Date::ITALY])  ->  date
 + *    Date.iso8601(string='-4712-01-01'[, start=Date::ITALY], limit: 128)  ->  date
  *
  * Creates a new Date object by parsing from a string according to
  * some typical ISO 8601 formats.
@@ -4408,13 +4452,18 @@ date_s__iso8601(VALUE klass, VALUE str)
  *    Date.iso8601('2001-02-03')	#=> #<Date: 2001-02-03 ...>
  *    Date.iso8601('20010203')		#=> #<Date: 2001-02-03 ...>
  *    Date.iso8601('2001-W05-6')	#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_iso8601(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -4424,38 +4473,56 @@ date_s_iso8601(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__iso8601(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__iso8601(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    Date._rfc3339(string)  ->  hash
 + *    Date._rfc3339(string, limit: 128)  ->  hash
  *
  * Returns a hash of parsed elements.
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 -date_s__rfc3339(VALUE klass, VALUE str)
 +date_s__rfc3339(int argc, VALUE *argv, VALUE klass)
 {
 +    VALUE str, opt;
 +
 +    rb_scan_args(argc, argv, "1:", &str, &opt);
 +    check_limit(str, opt);
 +
     return date__rfc3339(str);
 }
 /*
  * call-seq:
 - *    Date.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  date
 + *    Date.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  date
  *
  * Creates a new Date object by parsing from a string according to
  * some typical RFC 3339 formats.
  *
  *    Date.rfc3339('2001-02-03T04:05:06+07:00')	#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_rfc3339(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -4465,38 +4532,56 @@ date_s_rfc3339(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__rfc3339(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__rfc3339(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    Date._xmlschema(string)  ->  hash
 + *    Date._xmlschema(string, limit: 128)  ->  hash
  *
  * Returns a hash of parsed elements.
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 -date_s__xmlschema(VALUE klass, VALUE str)
 +date_s__xmlschema(int argc, VALUE *argv, VALUE klass)
 {
 +    VALUE str, opt;
 +
 +    rb_scan_args(argc, argv, "1:", &str, &opt);
 +    check_limit(str, opt);
 +
     return date__xmlschema(str);
 }
 /*
  * call-seq:
 - *    Date.xmlschema(string='-4712-01-01'[, start=Date::ITALY])  ->  date
 + *    Date.xmlschema(string='-4712-01-01'[, start=Date::ITALY], limit: 128)  ->  date
  *
  * Creates a new Date object by parsing from a string according to
  * some typical XML Schema formats.
  *
  *    Date.xmlschema('2001-02-03')	#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_xmlschema(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -4506,41 +4591,58 @@ date_s_xmlschema(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__xmlschema(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__xmlschema(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    Date._rfc2822(string)  ->  hash
 - *    Date._rfc822(string)   ->  hash
 + *    Date._rfc2822(string, limit: 128)  ->  hash
 + *    Date._rfc822(string, limit: 128)   ->  hash
  *
  * Returns a hash of parsed elements.
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 -date_s__rfc2822(VALUE klass, VALUE str)
 +date_s__rfc2822(int argc, VALUE *argv, VALUE klass)
 {
 +    VALUE str, opt;
 +
 +    rb_scan_args(argc, argv, "1:", &str, &opt);
 +    check_limit(str, opt);
 +
     return date__rfc2822(str);
 }
 /*
  * call-seq:
 - *    Date.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])  ->  date
 - *    Date.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])   ->  date
 + *    Date.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)  ->  date
 + *    Date.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)   ->  date
  *
  * Creates a new Date object by parsing from a string according to
  * some typical RFC 2822 formats.
  *
  *    Date.rfc2822('Sat, 3 Feb 2001 00:00:00 +0000')
  *						#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_rfc2822(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
     switch (argc) {
       case 0:
@@ -4550,39 +4652,56 @@ date_s_rfc2822(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__rfc2822(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__rfc2822(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    Date._httpdate(string)  ->  hash
 + *    Date._httpdate(string, limit: 128)  ->  hash
  *
  * Returns a hash of parsed elements.
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 -date_s__httpdate(VALUE klass, VALUE str)
 +date_s__httpdate(int argc, VALUE *argv, VALUE klass)
 {
 +    VALUE str, opt;
 +
 +    rb_scan_args(argc, argv, "1:", &str, &opt);
 +    check_limit(str, opt);
 +
     return date__httpdate(str);
 }
 /*
  * call-seq:
 - *    Date.httpdate(string='Mon, 01 Jan -4712 00:00:00 GMT'[, start=Date::ITALY])  ->  date
 + *    Date.httpdate(string='Mon, 01 Jan -4712 00:00:00 GMT'[, start=Date::ITALY], limit: 128)  ->  date
  *
  * Creates a new Date object by parsing from a string according to
  * some RFC 2616 format.
  *
  *    Date.httpdate('Sat, 03 Feb 2001 00:00:00 GMT')
  *						#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_httpdate(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
     switch (argc) {
       case 0:
@@ -4592,38 +4711,56 @@ date_s_httpdate(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__httpdate(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__httpdate(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    Date._jisx0301(string)  ->  hash
 + *    Date._jisx0301(string, limit: 128)  ->  hash
  *
  * Returns a hash of parsed elements.
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 -date_s__jisx0301(VALUE klass, VALUE str)
 +date_s__jisx0301(int argc, VALUE *argv, VALUE klass)
 {
 +    VALUE str, opt;
 +
 +    rb_scan_args(argc, argv, "1:", &str, &opt);
 +    check_limit(str, opt);
 +
     return date__jisx0301(str);
 }
 /*
  * call-seq:
 - *    Date.jisx0301(string='-4712-01-01'[, start=Date::ITALY])  ->  date
 + *    Date.jisx0301(string='-4712-01-01'[, start=Date::ITALY], limit: 128)  ->  date
  *
  * Creates a new Date object by parsing from a string according to
  * some typical JIS X 0301 formats.
  *
  *    Date.jisx0301('H13.02.03')		#=> #<Date: 2001-02-03 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 date_s_jisx0301(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -4633,7 +4770,11 @@ date_s_jisx0301(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__jisx0301(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        if (!NIL_P(opt)) argv2[argc2++] = opt;
 +	VALUE hash = date_s__jisx0301(argc2, argv2, klass);
 	return d_new_by_frags(klass, hash, sg);
     }
 }
@@ -7925,7 +8066,7 @@ datetime_s_strptime(int argc, VALUE *argv, VALUE klass)
 /*
  * call-seq:
 - *    DateTime.parse(string='-4712-01-01T00:00:00+00:00'[, comp=true[, start=Date::ITALY]])  ->  datetime
 + *    DateTime.parse(string='-4712-01-01T00:00:00+00:00'[, comp=true[, start=Date::ITALY]], limit: 128)  ->  datetime
  *
  * Parses the given representation of date and time, and creates a
  * DateTime object.  This method does not function as a validator.
@@ -7939,13 +8080,18 @@ datetime_s_strptime(int argc, VALUE *argv, VALUE klass)
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
  *    DateTime.parse('3rd Feb 2001 04:05:06 PM')
  *				#=> #<DateTime: 2001-02-03T16:05:06+00:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_parse(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, comp, sg;
 +    VALUE str, comp, sg, opt;
 -    rb_scan_args(argc, argv, "03", &str, &comp, &sg);
 +    rb_scan_args(argc, argv, "03:", &str, &comp, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -7957,18 +8103,20 @@ datetime_s_parse(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE argv2[2], hash;
 -
 -	argv2[0] = str;
 -	argv2[1] = comp;
 -	hash = date_s__parse(2, argv2, klass);
 +        int argc2 = 2;
 +        VALUE argv2[3];
 +        argv2[0] = str;
 +        argv2[1] = comp;
 +        argv2[2] = opt;
 +        if (!NIL_P(opt)) argc2++;
 +	VALUE hash = date_s__parse(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    DateTime.iso8601(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
 + *    DateTime.iso8601(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
  *
  * Creates a new DateTime object by parsing from a string according to
  * some typical ISO 8601 formats.
@@ -7979,13 +8127,18 @@ datetime_s_parse(int argc, VALUE *argv, VALUE klass)
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
  *    DateTime.iso8601('2001-W05-6T04:05:06+07:00')
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_iso8601(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -7995,27 +8148,37 @@ datetime_s_iso8601(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__iso8601(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        argv2[1] = opt;
 +        if (!NIL_P(opt)) argc2--;
 +	VALUE hash = date_s__iso8601(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    DateTime.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
 + *    DateTime.rfc3339(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
  *
  * Creates a new DateTime object by parsing from a string according to
  * some typical RFC 3339 formats.
  *
  *    DateTime.rfc3339('2001-02-03T04:05:06+07:00')
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_rfc3339(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -8025,27 +8188,37 @@ datetime_s_rfc3339(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__rfc3339(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        argv2[1] = opt;
 +        if (!NIL_P(opt)) argc2++;
 +	VALUE hash = date_s__rfc3339(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    DateTime.xmlschema(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
 + *    DateTime.xmlschema(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
  *
  * Creates a new DateTime object by parsing from a string according to
  * some typical XML Schema formats.
  *
  *    DateTime.xmlschema('2001-02-03T04:05:06+07:00')
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_xmlschema(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -8055,28 +8228,38 @@ datetime_s_xmlschema(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__xmlschema(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        argv2[1] = opt;
 +        if (!NIL_P(opt)) argc2++;
 +	VALUE hash = date_s__xmlschema(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    DateTime.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])  ->  datetime
 - *    DateTime.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY])   ->  datetime
 + *    DateTime.rfc2822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)  ->  datetime
 + *    DateTime.rfc822(string='Mon, 1 Jan -4712 00:00:00 +0000'[, start=Date::ITALY], limit: 128)   ->  datetime
  *
  * Creates a new DateTime object by parsing from a string according to
  * some typical RFC 2822 formats.
  *
  *     DateTime.rfc2822('Sat, 3 Feb 2001 04:05:06 +0700')
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_rfc2822(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -8086,7 +8269,12 @@ datetime_s_rfc2822(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__rfc2822(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        argv2[1] = opt;
 +        if (!NIL_P(opt)) argc2++;
 +	VALUE hash = date_s__rfc2822(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
@@ -8100,13 +8288,18 @@ datetime_s_rfc2822(int argc, VALUE *argv, VALUE klass)
  *
  *    DateTime.httpdate('Sat, 03 Feb 2001 04:05:06 GMT')
  *				#=> #<DateTime: 2001-02-03T04:05:06+00:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_httpdate(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -8116,27 +8309,37 @@ datetime_s_httpdate(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__httpdate(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        argv2[1] = opt;
 +        if (!NIL_P(opt)) argc2++;
 +	VALUE hash = date_s__httpdate(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
 /*
  * call-seq:
 - *    DateTime.jisx0301(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY])  ->  datetime
 + *    DateTime.jisx0301(string='-4712-01-01T00:00:00+00:00'[, start=Date::ITALY], limit: 128)  ->  datetime
  *
  * Creates a new DateTime object by parsing from a string according to
  * some typical JIS X 0301 formats.
  *
  *    DateTime.jisx0301('H13.02.03T04:05:06+07:00')
  *				#=> #<DateTime: 2001-02-03T04:05:06+07:00 ...>
 + *
 + * Raise an ArgumentError when the string length is longer than _limit_.
 + * You can stop this check by passing , but note that
 + * it may take a long time to parse.
  */
 static VALUE
 datetime_s_jisx0301(int argc, VALUE *argv, VALUE klass)
 {
 -    VALUE str, sg;
 +    VALUE str, sg, opt;
 -    rb_scan_args(argc, argv, "02", &str, &sg);
 +    rb_scan_args(argc, argv, "02:", &str, &sg, &opt);
 +    if (!NIL_P(opt)) argc--;
     switch (argc) {
       case 0:
@@ -8146,7 +8349,12 @@ datetime_s_jisx0301(int argc, VALUE *argv, VALUE klass)
     }
     {
 -	VALUE hash = date_s__jisx0301(klass, str);
 +        int argc2 = 1;
 +        VALUE argv2[2];
 +        argv2[0] = str;
 +        argv2[1] = opt;
 +        if (!NIL_P(opt)) argc2++;
 +	VALUE hash = date_s__jisx0301(argc2, argv2, klass);
 	return dt_new_by_frags(klass, hash, sg);
     }
 }
@@ -9297,19 +9505,19 @@ Init_date_core(void)
     rb_define_singleton_method(cDate, "strptime", date_s_strptime, -1);
     rb_define_singleton_method(cDate, "_parse", date_s__parse, -1);
     rb_define_singleton_method(cDate, "parse", date_s_parse, -1);
 -    rb_define_singleton_method(cDate, "_iso8601", date_s__iso8601, 1);
 +    rb_define_singleton_method(cDate, "_iso8601", date_s__iso8601, -1);
     rb_define_singleton_method(cDate, "iso8601", date_s_iso8601, -1);
 -    rb_define_singleton_method(cDate, "_rfc3339", date_s__rfc3339, 1);
 +    rb_define_singleton_method(cDate, "_rfc3339", date_s__rfc3339, -1);
     rb_define_singleton_method(cDate, "rfc3339", date_s_rfc3339, -1);
 -    rb_define_singleton_method(cDate, "_xmlschema", date_s__xmlschema, 1);
 +    rb_define_singleton_method(cDate, "_xmlschema", date_s__xmlschema, -1);
     rb_define_singleton_method(cDate, "xmlschema", date_s_xmlschema, -1);
 -    rb_define_singleton_method(cDate, "_rfc2822", date_s__rfc2822, 1);
 -    rb_define_singleton_method(cDate, "_rfc822", date_s__rfc2822, 1);
 +    rb_define_singleton_method(cDate, "_rfc2822", date_s__rfc2822, -1);
 +    rb_define_singleton_method(cDate, "_rfc822", date_s__rfc2822, -1);
     rb_define_singleton_method(cDate, "rfc2822", date_s_rfc2822, -1);
     rb_define_singleton_method(cDate, "rfc822", date_s_rfc2822, -1);
 -    rb_define_singleton_method(cDate, "_httpdate", date_s__httpdate, 1);
 +    rb_define_singleton_method(cDate, "_httpdate", date_s__httpdate, -1);
     rb_define_singleton_method(cDate, "httpdate", date_s_httpdate, -1);
 -    rb_define_singleton_method(cDate, "_jisx0301", date_s__jisx0301, 1);
 +    rb_define_singleton_method(cDate, "_jisx0301", date_s__jisx0301, -1);
     rb_define_singleton_method(cDate, "jisx0301", date_s_jisx0301, -1);
 #ifndef NDEBUG
 diff --git a/test/date/test_date_parse.rb b/test/date/test_date_parse.rb
 index ac0eb85..f9b160e 100644
 --- a/test/date/test_date_parse.rb
 +++ b/test/date/test_date_parse.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require 'test/unit'
 require 'date'
 +require 'timeout'
 class TestDateParse < Test::Unit::TestCase
@@ -1122,4 +1123,32 @@ class TestDateParse < Test::Unit::TestCase
     assert_equal(s0, s)
   end
 +  def test_length_limit
 +    assert_raise(ArgumentError) { Date._parse("1" * 1000) }
 +    assert_raise(ArgumentError) { Date._iso8601("1" * 1000) }
 +    assert_raise(ArgumentError) { Date._rfc3339("1" * 1000) }
 +    assert_raise(ArgumentError) { Date._xmlschema("1" * 1000) }
 +    assert_raise(ArgumentError) { Date._rfc2822("1" * 1000) }
 +    assert_raise(ArgumentError) { Date._rfc822("1" * 1000) }
 +    assert_raise(ArgumentError) { Date._jisx0301("1" * 1000) }
 +
 +    assert_raise(ArgumentError) { Date.parse("1" * 1000) }
 +    assert_raise(ArgumentError) { Date.iso8601("1" * 1000) }
 +    assert_raise(ArgumentError) { Date.rfc3339("1" * 1000) }
 +    assert_raise(ArgumentError) { Date.xmlschema("1" * 1000) }
 +    assert_raise(ArgumentError) { Date.rfc2822("1" * 1000) }
 +    assert_raise(ArgumentError) { Date.rfc822("1" * 1000) }
 +    assert_raise(ArgumentError) { Date.jisx0301("1" * 1000) }
 +
 +    assert_raise(ArgumentError) { DateTime.parse("1" * 1000) }
 +    assert_raise(ArgumentError) { DateTime.iso8601("1" * 1000) }
 +    assert_raise(ArgumentError) { DateTime.rfc3339("1" * 1000) }
 +    assert_raise(ArgumentError) { DateTime.xmlschema("1" * 1000) }
 +    assert_raise(ArgumentError) { DateTime.rfc2822("1" * 1000) }
 +    assert_raise(ArgumentError) { DateTime.rfc822("1" * 1000) }
 +    assert_raise(ArgumentError) { DateTime.jisx0301("1" * 1000) }
 +
 +    assert_raise(ArgumentError) { Date._parse("Jan " + "9" * 1000000) }
 +    assert_raise(Timeout::Error) { Timeout.timeout(1) { Date._parse("Jan " + "9" * 1000000, limit: nil) } }
 +  end
 end
 -- 
 2.33.0
--- a/backport-0002-CVE-2021-41817.patch
+++ b/backport-0002-CVE-2021-41817.patch
@ -0,0 +1,101 @@
 From fa674cf7230e40bc96625ee97a6057e48bb20f0f Mon Sep 17 00:00:00 2001
 From: Jean Boussier <jean.boussier@gmail.com>
 Date: Mon, 15 Nov 2021 11:37:40 +0100
 Subject: [PATCH] [ruby/date] `Date._<format>(nil)` should return an empty Hash
 Fix: https://github.com/ruby/date/issues/39
 This is how versions previous to 3.2.1 behaved and Active Support
 currently rely on this behavior.
 https://github.com/rails/rails/blob/90357af08048ef5076730505f6e7b14a81f33d0c/activesupport/lib/active_support/values/time_zone.rb#L383-L384
 Any Rails application upgrading to date `3.2.1` might run into unexpected errors.
 https://github.com/ruby/date/commit/8f2d7a0c7e
 ---
 ext/date/date_core.c         |  2 ++
 test/date/test_date_parse.rb | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)
 diff --git a/ext/date/date_core.c b/ext/date/date_core.c
 index 177ea0f..516640b 100644
 --- a/ext/date/date_core.c
 +++ b/ext/date/date_core.c
@@ -4304,6 +4304,8 @@ get_limit(VALUE opt)
 static void
 check_limit(VALUE str, VALUE opt)
 {
 +    if (NIL_P(str)) return;
 +
     StringValue(str);
     size_t slen = RSTRING_LEN(str);
     size_t limit = get_limit(opt);
 diff --git a/test/date/test_date_parse.rb b/test/date/test_date_parse.rb
 index f9b160e..dfc018b 100644
 --- a/test/date/test_date_parse.rb
 +++ b/test/date/test_date_parse.rb
@@ -824,6 +824,9 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._iso8601('')
     assert_equal({}, h)
 +
 +    h = Date._iso8601(nil)
 +    assert_equal({}, h)
   end
   def test__rfc3339
@@ -839,6 +842,9 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._rfc3339('')
     assert_equal({}, h)
 +
 +    h = Date._rfc3339(nil)
 +    assert_equal({}, h)
   end
   def test__xmlschema
@@ -921,6 +927,9 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._xmlschema('')
     assert_equal({}, h)
 +
 +    h = Date._xmlschema(nil)
 +    assert_equal({}, h)
   end
   def test__rfc2822
@@ -953,6 +962,9 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._rfc2822('')
     assert_equal({}, h)
 +
 +    h = Date._rfc2822(nil)
 +    assert_equal({}, h)
   end
   def test__httpdate
@@ -973,6 +985,9 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._httpdate('')
     assert_equal({}, h)
 +
 +    h = Date._httpdate(nil)
 +    assert_equal({}, h)
   end
   def test__jisx0301
@@ -1001,6 +1016,9 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._jisx0301('')
     assert_equal({}, h)
 +
 +    h = Date._jisx0301(nil)
 +    assert_equal({}, h)
   end
   def test_iso8601
 -- 
 2.33.0
--- a/backport-0003-CVE-2021-41817.patch
+++ b/backport-0003-CVE-2021-41817.patch
@ -0,0 +1,97 @@
 From a87c56f820dac90d50544ad33cc546daa9f29a9a Mon Sep 17 00:00:00 2001
 From: Jean Boussier <jean.boussier@gmail.com>
 Date: Tue, 16 Nov 2021 14:03:42 +0100
 Subject: [PATCH] [ruby/date] check_limit: also handle symbols
 https://github.com/ruby/date/commit/376c65942b
 ---
 ext/date/date_core.c         |  1 +
 test/date/test_date_parse.rb | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)
 diff --git a/ext/date/date_core.c b/ext/date/date_core.c
 index 516640b..0a9468a 100644
 --- a/ext/date/date_core.c
 +++ b/ext/date/date_core.c
@@ -4305,6 +4305,7 @@ static void
 check_limit(VALUE str, VALUE opt)
 {
     if (NIL_P(str)) return;
 +    if (SYMBOL_P(str)) str = rb_sym2str(str);
     StringValue(str);
     size_t slen = RSTRING_LEN(str);
 diff --git a/test/date/test_date_parse.rb b/test/date/test_date_parse.rb
 index dfc018b..5bc2ceb 100644
 --- a/test/date/test_date_parse.rb
 +++ b/test/date/test_date_parse.rb
@@ -827,6 +827,10 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._iso8601(nil)
     assert_equal({}, h)
 +
 +    h = Date._iso8601('01-02-03T04:05:06Z'.to_sym)
 +    assert_equal([2001, 2, 3, 4, 5, 6, 0],
 +      h.values_at(:year, :mon, :mday, :hour, :min, :sec, :offset))
   end
   def test__rfc3339
@@ -845,6 +849,10 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._rfc3339(nil)
     assert_equal({}, h)
 +
 +    h = Date._rfc3339('2001-02-03T04:05:06Z'.to_sym)
 +    assert_equal([2001, 2, 3, 4, 5, 6, 0],
 +      h.values_at(:year, :mon, :mday, :hour, :min, :sec, :offset))
   end
   def test__xmlschema
@@ -930,6 +938,10 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._xmlschema(nil)
     assert_equal({}, h)
 +
 +    h = Date._xmlschema('2001-02-03'.to_sym)
 +    assert_equal([2001, 2, 3, nil, nil, nil, nil],
 +      h.values_at(:year, :mon, :mday, :hour, :min, :sec, :offset))
   end
   def test__rfc2822
@@ -965,6 +977,10 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._rfc2822(nil)
     assert_equal({}, h)
 +
 +    h = Date._rfc2822('Sat, 3 Feb 2001 04:05:06 UT'.to_sym)
 +    assert_equal([2001, 2, 3, 4, 5, 6, 0],
 +      h.values_at(:year, :mon, :mday, :hour, :min, :sec, :offset))
   end
   def test__httpdate
@@ -988,6 +1004,10 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._httpdate(nil)
     assert_equal({}, h)
 +
 +    h = Date._httpdate('Sat, 03 Feb 2001 04:05:06 GMT'.to_sym)
 +    assert_equal([2001, 2, 3, 4, 5, 6, 0],
 +      h.values_at(:year, :mon, :mday, :hour, :min, :sec, :offset))
   end
   def test__jisx0301
@@ -1019,6 +1039,10 @@ class TestDateParse < Test::Unit::TestCase
     h = Date._jisx0301(nil)
     assert_equal({}, h)
 +
 +    h = Date._jisx0301('H13.02.03T04:05:06.07+0100'.to_sym)
 +    assert_equal([2001, 2, 3, 4, 5, 6, 3600],
 +      h.values_at(:year, :mon, :mday, :hour, :min, :sec, :offset))
   end
   def test_iso8601
 -- 
 2.33.0
--- a/backport-CVE-2024-39908-CVE-2024-41123-upgrade-lib-rexml-to-3.3.3.patch
+++ b/backport-CVE-2024-39908-CVE-2024-41123-upgrade-lib-rexml-to-3.3.3.patch
@ -0,0 +1,372 @@
 From e4a067e11235a2ec7a00616d41350485e384ec05 Mon Sep 17 00:00:00 2001
 From: Sutou Kouhei <kou@clear-code.com>
 Date: Thu, 1 Aug 2024 11:51:33 +0900
 Subject: [PATCH] Add 3.3.3 entry
 ---
 lib/rexml/formatters/pretty.rb            |  2 +-
 lib/rexml/parsers/baseparser.rb           | 67 ++++++++++++++-----
 lib/rexml/parsers/sax2parser.rb           | 21 +-----
 lib/rexml/parsers/streamparser.rb         |  4 +-
 lib/rexml/rexml.rb                        |  2 +-
 lib/rexml/source.rb                       | 22 ++++--
 lib/rexml/text.rb                         | 48 +++++++++----
 7 files changed, 105 insertions(+), 61 deletions(-)
 diff --git a/lib/rexml/formatters/pretty.rb b/lib/rexml/formatters/pretty.rb
 index a1198b7..a838d83 100644
 --- a/lib/rexml/formatters/pretty.rb
 +++ b/lib/rexml/formatters/pretty.rb
@@ -111,7 +111,7 @@ module REXML
         # itself, then we don't need a carriage return... which makes this
         # logic more complex.
         node.children.each { |child|
 -          next if child == node.children[-1] and child.instance_of?(Text)
 +          next if child.instance_of?(Text)
           unless child == node.children[0] or child.instance_of?(Text) or
             (child == node.children[1] and !node.children[0].writethis)
             output << "\n"
 diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
 index 617a3d5..44dc658 100644
 --- a/lib/rexml/parsers/baseparser.rb
 +++ b/lib/rexml/parsers/baseparser.rb
@@ -124,11 +124,10 @@ module REXML
       }
       module Private
 -        INSTRUCTION_END = /#{NAME}(\s+.*?)?\?>/um
         TAG_PATTERN = /((?>#{QNAME_STR}))\s*/um
         CLOSE_PATTERN = /(#{QNAME_STR})\s*>/um
         ATTLISTDECL_END = /\s+#{NAME}(?:#{ATTDEF})*\s*>/um
 -        NAME_PATTERN = /\s*#{NAME}/um
 +        NAME_PATTERN = /#{NAME}/um
         GEDECL_PATTERN = "\\s+#{NAME}\\s+#{ENTITYDEF}\\s*>"
         PEDECL_PATTERN = "\\s+(%)\\s+#{NAME}\\s+#{PEDEF}\\s*>"
         ENTITYDECL_PATTERN = /(?:#{GEDECL_PATTERN})|(?:#{PEDECL_PATTERN})/um
@@ -159,6 +158,7 @@ module REXML
       def stream=( source )
         @source = SourceFactory.create_from( source )
         @closed = nil
 +        @have_root = false
         @document_status = nil
         @tags = []
         @stack = []
@@ -241,7 +241,7 @@ module REXML
         if @document_status == nil
           start_position = @source.position
           if @source.match("<?", true)
 -            return process_instruction(start_position)
 +            return process_instruction
           elsif @source.match("<!", true)
             if @source.match("--", true)
               md = @source.match(/(.*?)-->/um, true)
@@ -311,7 +311,11 @@ module REXML
               raise REXML::ParseException.new( "Bad ELEMENT declaration!", @source ) if md.nil?
               return [ :elementdecl, "<!ELEMENT" + md[1] ]
             elsif @source.match("ENTITY", true)
 -              match = [:entitydecl, *@source.match(Private::ENTITYDECL_PATTERN, true).captures.compact]
 +              match_data = @source.match(Private::ENTITYDECL_PATTERN, true)
 +              unless match_data
 +                raise REXML::ParseException.new("Malformed entity declaration", @source)
 +              end
 +              match = [:entitydecl, *match_data.captures.compact]
               ref = false
               if match[1] == '%'
                 ref = true
@@ -343,7 +347,7 @@ module REXML
               contents = md[0]
               pairs = {}
 -              values = md[0].scan( ATTDEF_RE )
 +              values = md[0].strip.scan( ATTDEF_RE )
               values.each do |attdef|
                 unless attdef[3] == "#IMPLIED"
                   attdef.compact!
@@ -437,7 +441,7 @@ module REXML
               raise REXML::ParseException.new( "Declarations can only occur "+
                 "in the doctype declaration.", @source)
             elsif @source.match("?", true)
 -              return process_instruction(start_position)
 +              return process_instruction
             else
               # Get the next tag
               md = @source.match(Private::TAG_PATTERN, true)
@@ -462,8 +466,12 @@ module REXML
                 @closed = tag
                 @nsstack.shift
               else
 +                if @tags.empty? and @have_root
 +                  raise ParseException.new("Malformed XML: Extra tag at the end of the document (got '<#{tag}')", @source)
 +                end
                 @tags.push( tag )
               end
 +              @have_root = true
               return [ :start_element, tag, attributes ]
             end
           else
@@ -471,6 +479,16 @@ module REXML
             if text.chomp!("<")
               @source.position -= "<".bytesize
             end
 +            if @tags.empty?
 +              unless /\A\s*\z/.match?(text)
 +                if @have_root
 +                  raise ParseException.new("Malformed XML: Extra content at the end of the document (got '#{text}')", @source)
 +                else
 +                  raise ParseException.new("Malformed XML: Content at the start of the document (got '#{text}')", @source)
 +                end
 +              end
 +              return pull_event if @have_root
 +            end
             return [ :text, text ]
           end
         rescue REXML::UndefinedNamespaceException
@@ -515,7 +533,11 @@ module REXML
       # Unescapes all possible entities
       def unnormalize( string, entities=nil, filter=nil )
 -        rv = string.gsub( Private::CARRIAGE_RETURN_NEWLINE_PATTERN, "\n" )
 +        if string.include?("\r")
 +          rv = string.gsub( Private::CARRIAGE_RETURN_NEWLINE_PATTERN, "\n" )
 +        else
 +          rv = string.dup
 +        end
         matches = rv.scan( REFERENCE_RE )
         return rv if matches.size == 0
         rv.gsub!( Private::CHARACTER_REFERENCES ) {
@@ -565,14 +587,14 @@ module REXML
       def parse_name(base_error_message)
         md = @source.match(Private::NAME_PATTERN, true)
         unless md
 -          if @source.match(/\s*\S/um)
 +          if @source.match(/\S/um)
             message = "#{base_error_message}: invalid name"
           else
             message = "#{base_error_message}: name is missing"
           end
           raise REXML::ParseException.new(message, @source)
         end
 -        md[1]
 +        md[0]
       end
       def parse_id(base_error_message,
@@ -641,15 +663,24 @@ module REXML
         end
       end
 -      def process_instruction(start_position)
 -        match_data = @source.match(Private::INSTRUCTION_END, true)
 -        unless match_data
 -          message = "Invalid processing instruction node"
 -          @source.position = start_position
 -          raise REXML::ParseException.new(message, @source)
 +      def process_instruction
 +        name = parse_name("Malformed XML: Invalid processing instruction node")
 +        if @source.match(/\s+/um, true)
 +          match_data = @source.match(/(.*?)\?>/um, true)
 +          unless match_data
 +            raise ParseException.new("Malformed XML: Unclosed processing instruction", @source)
 +          end
 +          content = match_data[1]
 +        else
 +          content = nil
 +          unless @source.match("?>", true)
 +            raise ParseException.new("Malformed XML: Unclosed processing instruction", @source)
 +          end
         end
 -        if @document_status.nil? and match_data[1] == "xml"
 -          content = match_data[2]
 +        if name == "xml"
 +          if @document_status
 +            raise ParseException.new("Malformed XML: XML declaration is not at the start", @source)
 +          end
           version = VERSION.match(content)
           version = version[1] unless version.nil?
           encoding = ENCODING.match(content)
@@ -664,7 +695,7 @@ module REXML
           standalone = standalone[1] unless standalone.nil?
           return [ :xmldecl, version, encoding, standalone ]
         end
 -        [:processing_instruction, match_data[1], match_data[2]]
 +        [:processing_instruction, name, content]
       end
       def parse_attributes(prefixes, curr_ns)
 diff --git a/lib/rexml/parsers/sax2parser.rb b/lib/rexml/parsers/sax2parser.rb
 index 01cb469..cec9d2f 100644
 --- a/lib/rexml/parsers/sax2parser.rb
 +++ b/lib/rexml/parsers/sax2parser.rb
@@ -161,25 +161,8 @@ module REXML
               end
             end
           when :text
 -            #normalized = @parser.normalize( event[1] )
 -            #handle( :characters, normalized )
 -            copy = event[1].clone
 -
 -            esub = proc { |match|
 -              if @entities.has_key?($1)
 -                @entities[$1].gsub(Text::REFERENCE, &esub)
 -              else
 -                match
 -              end
 -            }
 -
 -            copy.gsub!( Text::REFERENCE, &esub )
 -            copy.gsub!( Text::NUMERICENTITY ) {|m|
 -              m=$1
 -              m = "0#{m}" if m[0] == ?x
 -              [Integer(m)].pack('U*')
 -            }
 -            handle( :characters, copy )
 +            unnormalized = @parser.unnormalize( event[1], @entities )
 +            handle( :characters, unnormalized )
           when :entitydecl
             handle_entitydecl( event )
           when :processing_instruction, :comment, :attlistdecl,
 diff --git a/lib/rexml/parsers/streamparser.rb b/lib/rexml/parsers/streamparser.rb
 index 9e0eb0b..fa3ac49 100644
 --- a/lib/rexml/parsers/streamparser.rb
 +++ b/lib/rexml/parsers/streamparser.rb
@@ -36,8 +36,8 @@ module REXML
             @listener.tag_end( event[1] )
             @tag_stack.pop
           when :text
 -            normalized = @parser.unnormalize( event[1] )
 -            @listener.text( normalized )
 +            unnormalized = @parser.unnormalize( event[1] )
 +            @listener.text( unnormalized )
           when :processing_instruction
             @listener.instruction( *event[1,2] )
           when :start_doctype
 diff --git a/lib/rexml/rexml.rb b/lib/rexml/rexml.rb
 index 3af03ec..39e92a5 100644
 --- a/lib/rexml/rexml.rb
 +++ b/lib/rexml/rexml.rb
@@ -31,7 +31,7 @@
 module REXML
   COPYRIGHT = "Copyright © 2001-2008 Sean Russell <ser@germane-software.com>"
   DATE = "2008/019"
 -  VERSION = "3.3.1"
 +  VERSION = "3.3.3"
   REVISION = ""
   Copyright = COPYRIGHT
 diff --git a/lib/rexml/source.rb b/lib/rexml/source.rb
 index 5715c35..ff887fc 100644
 --- a/lib/rexml/source.rb
 +++ b/lib/rexml/source.rb
@@ -204,10 +204,20 @@ module REXML
       end
     end
 -    def read(term = nil)
 +    def read(term = nil, min_bytes = 1)
       term = encode(term) if term
       begin
 -        @scanner << readline(term)
 +        str = readline(term)
 +        @scanner << str
 +        read_bytes = str.bytesize
 +        begin
 +          while read_bytes < min_bytes
 +            str = readline(term)
 +            @scanner << str
 +            read_bytes += str.bytesize
 +          end
 +        rescue IOError
 +        end
         true
       rescue Exception, NameError
         @source = nil
@@ -237,10 +247,9 @@ module REXML
       read if @scanner.eos? && @source
     end
 -    # Note: When specifying a string for 'pattern', it must not include '>' except in the following formats:
 -    # - ">"
 -    # - "XXX>" (X is any string excluding '>')
     def match( pattern, cons=false )
 +      # To avoid performance issue, we need to increase bytes to read per scan
 +      min_bytes = 1
       while true
         if cons
           md = @scanner.scan(pattern)
@@ -250,7 +259,8 @@ module REXML
         break if md
         return nil if pattern.is_a?(String)
         return nil if @source.nil?
 -        return nil unless read
 +        return nil unless read(nil, min_bytes)
 +        min_bytes *= 2
       end
       md.nil? ? nil : @scanner
 diff --git a/lib/rexml/text.rb b/lib/rexml/text.rb
 index b47bad3..7e0befe 100644
 --- a/lib/rexml/text.rb
 +++ b/lib/rexml/text.rb
@@ -151,25 +151,45 @@ module REXML
         end
       end
 -      # context sensitive
 -      string.scan(pattern) do
 -        if $1[-1] != ?;
 -          raise "Illegal character #{$1.inspect} in raw string #{string.inspect}"
 -        elsif $1[0] == ?&
 -          if $5 and $5[0] == ?#
 -            case ($5[1] == ?x ? $5[2..-1].to_i(16) : $5[1..-1].to_i)
 -            when *VALID_CHAR
 +      pos = 0
 +      while (index = string.index(/<|&/, pos))
 +        if string[index] == "<"
 +          raise "Illegal character \"#{string[index]}\" in raw string #{string.inspect}"
 +        end
 +
 +        unless (end_index = string.index(/[^\s];/, index + 1))
 +          raise "Illegal character \"#{string[index]}\" in raw string #{string.inspect}"
 +        end
 +
 +        value = string[(index + 1)..end_index]
 +        if /\s/.match?(value)
 +          raise "Illegal character \"#{string[index]}\" in raw string #{string.inspect}"
 +        end
 +
 +        if value[0] == "#"
 +          character_reference = value[1..-1]
 +
 +          unless (/\A(\d+|x[0-9a-fA-F]+)\z/.match?(character_reference))
 +            if character_reference[0] == "x" || character_reference[-1] == "x"
 +              raise "Illegal character \"#{string[index]}\" in raw string #{string.inspect}"
             else
 -              raise "Illegal character #{$1.inspect} in raw string #{string.inspect}"
 +              raise "Illegal character #{string.inspect} in raw string #{string.inspect}"
             end
 -          # FIXME: below can't work but this needs API change.
 -          # elsif @parent and $3 and !SUBSTITUTES.include?($1)
 -          #   if !doctype or !doctype.entities.has_key?($3)
 -          #     raise "Undeclared entity '#{$1}' in raw string \"#{string}\""
 -          #   end
           end
 +
 +          case (character_reference[0] == "x" ? character_reference[1..-1].to_i(16) : character_reference[0..-1].to_i)
 +          when *VALID_CHAR
 +          else
 +            raise "Illegal character #{string.inspect} in raw string #{string.inspect}"
 +          end
 +        elsif !(/\A#{Entity::NAME}\z/um.match?(value))
 +          raise "Illegal character \"#{string[index]}\" in raw string #{string.inspect}"
         end
 +
 +        pos = end_index + 1
       end
 +
 +      string
     end
     def node_type
 -- 
 2.27.0
--- a/backport-CVE-2024-43398-upgrade-lib-rexml-to-3.3.6.patch
+++ b/backport-CVE-2024-43398-upgrade-lib-rexml-to-3.3.6.patch
@ -0,0 +1,524 @@
 From 95871f399eda642a022b03550479b7994895c742 Mon Sep 17 00:00:00 2001
 From: Sutou Kouhei <kou@clear-code.com>
 Date: Thu, 22 Aug 2024 09:54:49 +0900
 Subject: [PATCH] Add 3.3.6 entry
 ---
 lib/rexml/element.rb                      |  30 ++--
 lib/rexml/entity.rb                       |  52 +------
 lib/rexml/parsers/baseparser.rb           | 139 +++++++++++++-----
 lib/rexml/parsers/streamparser.rb         |  16 +-
 lib/rexml/parsers/treeparser.rb           |   7 -
 lib/rexml/rexml.rb                        |   2 +-
 6 files changed, 131 insertions(+), 115 deletions(-)
 diff --git a/lib/rexml/element.rb b/lib/rexml/element.rb
 index a5808d7..4e3a60b 100644
 --- a/lib/rexml/element.rb
 +++ b/lib/rexml/element.rb
@@ -441,9 +441,14 @@ module REXML
     # Related: #root_node, #document.
     #
     def root
 -      return elements[1] if self.kind_of? Document
 -      return self if parent.kind_of? Document or parent.nil?
 -      return parent.root
 +      target = self
 +      while target
 +        return target.elements[1] if target.kind_of? Document
 +        parent = target.parent
 +        return target if parent.kind_of? Document or parent.nil?
 +        target = parent
 +      end
 +      nil
     end
     # :call-seq:
@@ -619,8 +624,12 @@ module REXML
       else
         prefix = "xmlns:#{prefix}" unless prefix[0,5] == 'xmlns'
       end
 -      ns = attributes[ prefix ]
 -      ns = parent.namespace(prefix) if ns.nil? and parent
 +      ns = nil
 +      target = self
 +      while ns.nil? and target
 +        ns = target.attributes[prefix]
 +        target = target.parent
 +      end
       ns = '' if ns.nil? and prefix == 'xmlns'
       return ns
     end
@@ -2375,17 +2384,6 @@ module REXML
       elsif old_attr.kind_of? Hash
         old_attr[value.prefix] = value
       elsif old_attr.prefix != value.prefix
 -        # Check for conflicting namespaces
 -        if value.prefix != "xmlns" and old_attr.prefix != "xmlns"
 -          old_namespace = old_attr.namespace
 -          new_namespace = value.namespace
 -          if old_namespace == new_namespace
 -            raise ParseException.new(
 -                    "Namespace conflict in adding attribute \"#{value.name}\": "+
 -                    "Prefix \"#{old_attr.prefix}\" = \"#{old_namespace}\" and "+
 -                    "prefix \"#{value.prefix}\" = \"#{new_namespace}\"")
 -          end
 -        end
         store value.name, {old_attr.prefix => old_attr,
                            value.prefix    => value}
       else
 diff --git a/lib/rexml/entity.rb b/lib/rexml/entity.rb
 index 573db69..12bbad3 100644
 --- a/lib/rexml/entity.rb
 +++ b/lib/rexml/entity.rb
@@ -12,6 +12,7 @@ module REXML
     EXTERNALID = "(?:(?:(SYSTEM)\\s+#{SYSTEMLITERAL})|(?:(PUBLIC)\\s+#{PUBIDLITERAL}\\s+#{SYSTEMLITERAL}))"
     NDATADECL = "\\s+NDATA\\s+#{NAME}"
     PEREFERENCE = "%#{NAME};"
 +    PEREFERENCE_RE = /#{PEREFERENCE}/um
     ENTITYVALUE = %Q{((?:"(?:[^%&"]|#{PEREFERENCE}|#{REFERENCE})*")|(?:'([^%&']|#{PEREFERENCE}|#{REFERENCE})*'))}
     PEDEF = "(?:#{ENTITYVALUE}|#{EXTERNALID})"
     ENTITYDEF = "(?:#{ENTITYVALUE}|(?:#{EXTERNALID}(#{NDATADECL})?))"
@@ -19,7 +20,7 @@ module REXML
     GEDECL = "<!ENTITY\\s+#{NAME}\\s+#{ENTITYDEF}\\s*>"
     ENTITYDECL = /\s*(?:#{GEDECL})|(?:#{PEDECL})/um
 -    attr_reader :name, :external, :ref, :ndata, :pubid
 +    attr_reader :name, :external, :ref, :ndata, :pubid, :value
     # Create a new entity.  Simple entities can be constructed by passing a
     # name, value to the constructor; this creates a generic, plain entity
@@ -68,14 +69,11 @@ module REXML
     end
     # Evaluates to the unnormalized value of this entity; that is, replacing
 -    # all entities -- both %ent; and &ent; entities.  This differs from
 -    # +value()+ in that +value+ only replaces %ent; entities.
 +    # &ent; entities.
     def unnormalized
       document.record_entity_expansion unless document.nil?
 -      v = value()
 -      return nil if v.nil?
 -      @unnormalized = Text::unnormalize(v, parent)
 -      @unnormalized
 +      return nil if @value.nil?
 +      @unnormalized = Text::unnormalize(@value, parent)
     end
     #once :unnormalized
@@ -121,46 +119,6 @@ module REXML
       write rv
       rv
     end
 -
 -    PEREFERENCE_RE = /#{PEREFERENCE}/um
 -    # Returns the value of this entity.  At the moment, only internal entities
 -    # are processed.  If the value contains internal references (IE,
 -    # %blah;), those are replaced with their values.  IE, if the doctype
 -    # contains:
 -    #  <!ENTITY % foo "bar">
 -    #  <!ENTITY yada "nanoo %foo; nanoo>
 -    # then:
 -    #  doctype.entity('yada').value   #-> "nanoo bar nanoo"
 -    def value
 -      @resolved_value ||= resolve_value
 -    end
 -
 -    def parent=(other)
 -      @resolved_value = nil
 -      super
 -    end
 -
 -    private
 -    def resolve_value
 -      return nil if @value.nil?
 -      return @value unless @value.match?(PEREFERENCE_RE)
 -
 -      matches = @value.scan(PEREFERENCE_RE)
 -      rv = @value.clone
 -      if @parent
 -        sum = 0
 -        matches.each do |entity_reference|
 -          entity_value = @parent.entity( entity_reference[0] )
 -          if sum + entity_value.bytesize > Security.entity_expansion_text_limit
 -            raise "entity expansion has grown too large"
 -          else
 -            sum += entity_value.bytesize
 -          end
 -          rv.gsub!( /%#{entity_reference.join};/um, entity_value )
 -        end
 -      end
 -      rv
 -    end
   end
   # This is a set of entity constants -- the ones defined in the XML
 diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
 index 44dc658..d11c276 100644
 --- a/lib/rexml/parsers/baseparser.rb
 +++ b/lib/rexml/parsers/baseparser.rb
@@ -1,12 +1,29 @@
 # frozen_string_literal: true
 require_relative '../parseexception'
 require_relative '../undefinednamespaceexception'
 +require_relative '../security'
 require_relative '../source'
 require 'set'
 require "strscan"
 module REXML
   module Parsers
 +    unless [].respond_to?(:tally)
 +      module EnumerableTally
 +        refine Enumerable do
 +          def tally
 +            counts = {}
 +            each do |item|
 +              counts[item] ||= 0
 +              counts[item] += 1
 +            end
 +            counts
 +          end
 +        end
 +      end
 +      using EnumerableTally
 +    end
 +
     if StringScanner::Version < "3.0.8"
       module StringScannerCaptures
         refine StringScanner do
@@ -124,6 +141,7 @@ module REXML
       }
       module Private
 +        PEREFERENCE_PATTERN = /#{PEREFERENCE}/um
         TAG_PATTERN = /((?>#{QNAME_STR}))\s*/um
         CLOSE_PATTERN = /(#{QNAME_STR})\s*>/um
         ATTLISTDECL_END = /\s+#{NAME}(?:#{ATTDEF})*\s*>/um
@@ -163,7 +181,8 @@ module REXML
         @tags = []
         @stack = []
         @entities = []
 -        @nsstack = []
 +        @namespaces = {}
 +        @namespaces_restore_stack = []
       end
       def position
@@ -231,6 +250,10 @@ module REXML
           if @document_status == :in_doctype
             raise ParseException.new("Malformed DOCTYPE: unclosed", @source)
           end
 +          unless @tags.empty?
 +            path = "/" + @tags.join("/")
 +            raise ParseException.new("Missing end tag for '#{path}'", @source)
 +          end
           return [ :end_document ]
         end
         return @stack.shift if @stack.size > 0
@@ -263,7 +286,6 @@ module REXML
                 @source.position = start_position
                 raise REXML::ParseException.new(message, @source)
               end
 -              @nsstack.unshift(Set.new)
               name = parse_name(base_error_message)
               if @source.match(/\s*\[/um, true)
                 id = [nil, nil, nil]
@@ -333,6 +355,8 @@ module REXML
                 match[4] = match[4][1..-2] # HREF
                 match.delete_at(5) if match.size > 5 # Chop out NDATA decl
                 # match is [ :entity, name, PUBLIC, pubid, href(, ndata)? ]
 +              elsif Private::PEREFERENCE_PATTERN.match?(match[2])
 +                raise REXML::ParseException.new("Parameter entity references forbidden in internal subset: #{match[2]}", @source)
               else
                 match[2] = match[2][1..-2]
                 match.pop if match.size == 4
@@ -355,7 +379,7 @@ module REXML
                   val = attdef[4] if val == "#FIXED "
                   pairs[attdef[0]] = val
                   if attdef[0] =~ /^xmlns:(.*)/
 -                    @nsstack[0] << $1
 +                    @namespaces[$1] = val
                   end
                 end
               end
@@ -408,7 +432,7 @@ module REXML
             # here explicitly.
             @source.ensure_buffer
             if @source.match("/", true)
 -              @nsstack.shift
 +              @namespaces_restore_stack.pop
               last_tag = @tags.pop
               md = @source.match(Private::CLOSE_PATTERN, true)
               if md and !last_tag
@@ -453,18 +477,18 @@ module REXML
               @document_status = :in_element
               @prefixes.clear
               @prefixes << md[2] if md[2]
 -              @nsstack.unshift(curr_ns=Set.new)
 -              attributes, closed = parse_attributes(@prefixes, curr_ns)
 +              push_namespaces_restore
 +              attributes, closed = parse_attributes(@prefixes)
               # Verify that all of the prefixes have been defined
               for prefix in @prefixes
 -                unless @nsstack.find{|k| k.member?(prefix)}
 +                unless @namespaces.key?(prefix)
                   raise UndefinedNamespaceException.new(prefix,@source,self)
                 end
               end
               if closed
                 @closed = tag
 -                @nsstack.shift
 +                pop_namespaces_restore
               else
                 if @tags.empty? and @have_root
                   raise ParseException.new("Malformed XML: Extra tag at the end of the document (got '<#{tag}')", @source)
@@ -504,15 +528,13 @@ module REXML
       private :pull_event
       def entity( reference, entities )
 -        value = nil
 -        value = entities[ reference ] if entities
 -        if value
 -          record_entity_expansion
 -        else
 -          value = DEFAULT_ENTITIES[ reference ]
 -          value = value[2] if value
 -        end
 -        unnormalize( value, entities ) if value
 +        return unless entities
 +
 +        value = entities[ reference ]
 +        return if value.nil?
 +
 +        record_entity_expansion
 +        unnormalize( value, entities )
       end
       # Escapes all possible entities
@@ -546,22 +568,29 @@ module REXML
           [Integer(m)].pack('U*')
         }
         matches.collect!{|x|x[0]}.compact!
 +        if filter
 +          matches.reject! do |entity_reference|
 +            filter.include?(entity_reference)
 +          end
 +        end
         if matches.size > 0
 -          sum = 0
 -          matches.each do |entity_reference|
 -            unless filter and filter.include?(entity_reference)
 -              entity_value = entity( entity_reference, entities )
 -              if entity_value
 -                re = Private::DEFAULT_ENTITIES_PATTERNS[entity_reference] || /&#{entity_reference};/
 -                rv.gsub!( re, entity_value )
 -                sum += rv.bytesize
 -                if sum > Security.entity_expansion_text_limit
 -                  raise "entity expansion has grown too large"
 -                end
 -              else
 -                er = DEFAULT_ENTITIES[entity_reference]
 -                rv.gsub!( er[0], er[2] ) if er
 +          matches.tally.each do |entity_reference, n|
 +            entity_expansion_count_before = @entity_expansion_count
 +            entity_value = entity( entity_reference, entities )
 +            if entity_value
 +              if n > 1
 +                entity_expansion_count_delta =
 +                  @entity_expansion_count - entity_expansion_count_before
 +                record_entity_expansion(entity_expansion_count_delta * (n - 1))
               end
 +              re = Private::DEFAULT_ENTITIES_PATTERNS[entity_reference] || /&#{entity_reference};/
 +              rv.gsub!( re, entity_value )
 +              if rv.bytesize > Security.entity_expansion_text_limit
 +                raise "entity expansion has grown too large"
 +              end
 +            else
 +              er = DEFAULT_ENTITIES[entity_reference]
 +              rv.gsub!( er[0], er[2] ) if er
             end
           end
           rv.gsub!( Private::DEFAULT_ENTITIES_PATTERNS['amp'], '&' )
@@ -570,9 +599,34 @@ module REXML
       end
       private
 +      def add_namespace(prefix, uri)
 +        @namespaces_restore_stack.last[prefix] = @namespaces[prefix]
 +        if uri.nil?
 +          @namespaces.delete(prefix)
 +        else
 +          @namespaces[prefix] = uri
 +        end
 +      end
 +
 +      def push_namespaces_restore
 +        namespaces_restore = {}
 +        @namespaces_restore_stack.push(namespaces_restore)
 +        namespaces_restore
 +      end
 -      def record_entity_expansion
 -        @entity_expansion_count += 1
 +      def pop_namespaces_restore
 +        namespaces_restore = @namespaces_restore_stack.pop
 +        namespaces_restore.each do |prefix, uri|
 +          if uri.nil?
 +            @namespaces.delete(prefix)
 +          else
 +            @namespaces[prefix] = uri
 +          end
 +        end
 +      end
 +
 +      def record_entity_expansion(delta=1)
 +        @entity_expansion_count += delta
         if @entity_expansion_count > Security.entity_expansion_limit
           raise "number of entity expansions exceeded, processing aborted."
         end
@@ -698,8 +752,9 @@ module REXML
         [:processing_instruction, name, content]
       end
 -      def parse_attributes(prefixes, curr_ns)
 +      def parse_attributes(prefixes)
         attributes = {}
 +        expanded_names = {}
         closed = false
         while true
           if @source.match(">", true)
@@ -741,7 +796,7 @@ module REXML
                   "(http://www.w3.org/TR/REC-xml-names/#ns-decl)"
                 raise REXML::ParseException.new( msg, @source, self)
               end
 -              curr_ns << local_part
 +              add_namespace(local_part, value)
             elsif prefix
               prefixes << prefix unless prefix == "xml"
             end
@@ -751,6 +806,20 @@ module REXML
               raise REXML::ParseException.new(msg, @source, self)
             end
 +            unless prefix == "xmlns"
 +              uri = @namespaces[prefix]
 +              expanded_name = [uri, local_part]
 +              existing_prefix = expanded_names[expanded_name]
 +              if existing_prefix
 +                message = "Namespace conflict in adding attribute " +
 +                          "\"#{local_part}\": " +
 +                          "Prefix \"#{existing_prefix}\" = \"#{uri}\" and " +
 +                          "prefix \"#{prefix}\" = \"#{uri}\""
 +                raise REXML::ParseException.new(message, @source, self)
 +              end
 +              expanded_names[expanded_name] = prefix
 +            end
 +
             attributes[name] = value
           else
             message = "Invalid attribute name: <#{@source.buffer.split(%r{[/>\s]}).first}>"
 diff --git a/lib/rexml/parsers/streamparser.rb b/lib/rexml/parsers/streamparser.rb
 index fa3ac49..7781fe4 100644
 --- a/lib/rexml/parsers/streamparser.rb
 +++ b/lib/rexml/parsers/streamparser.rb
@@ -7,36 +7,33 @@ module REXML
       def initialize source, listener
         @listener = listener
         @parser = BaseParser.new( source )
 -        @tag_stack = []
 +        @entities = {}
       end
       def add_listener( listener )
         @parser.add_listener( listener )
       end
 +      def entity_expansion_count
 +        @parser.entity_expansion_count
 +      end
 +
       def parse
         # entity string
         while true
           event = @parser.pull
           case event[0]
           when :end_document
 -            unless @tag_stack.empty?
 -              tag_path = "/" + @tag_stack.join("/")
 -              raise ParseException.new("Missing end tag for '#{tag_path}'",
 -                                       @parser.source)
 -            end
             return
           when :start_element
 -            @tag_stack << event[1]
             attrs = event[2].each do |n, v|
               event[2][n] = @parser.unnormalize( v )
             end
             @listener.tag_start( event[1], attrs )
           when :end_element
             @listener.tag_end( event[1] )
 -            @tag_stack.pop
           when :text
 -            unnormalized = @parser.unnormalize( event[1] )
 +            unnormalized = @parser.unnormalize( event[1], @entities )
             @listener.text( unnormalized )
           when :processing_instruction
             @listener.instruction( *event[1,2] )
@@ -48,6 +45,7 @@ module REXML
           when :comment, :attlistdecl, :cdata, :xmldecl, :elementdecl
             @listener.send( event[0].to_s, *event[1..-1] )
           when :entitydecl, :notationdecl
 +            @entities[ event[1] ] = event[2] if event.size == 3
             @listener.send( event[0].to_s, event[1..-1] )
           when :externalentity
             entity_reference = event[1]
 diff --git a/lib/rexml/parsers/treeparser.rb b/lib/rexml/parsers/treeparser.rb
 index 0cb6f7c..4565a40 100644
 --- a/lib/rexml/parsers/treeparser.rb
 +++ b/lib/rexml/parsers/treeparser.rb
@@ -15,7 +15,6 @@ module REXML
       end
       def parse
 -        tag_stack = []
         entities = nil
         begin
           while true
@@ -23,19 +22,13 @@ module REXML
             #STDERR.puts "TREEPARSER GOT #{event.inspect}"
             case event[0]
             when :end_document
 -              unless tag_stack.empty?
 -                raise ParseException.new("No close tag for #{@build_context.xpath}",
 -                                         @parser.source, @parser)
 -              end
               return
             when :start_element
 -              tag_stack.push(event[1])
               el = @build_context = @build_context.add_element( event[1] )
               event[2].each do |key, value|
                 el.attributes[key]=Attribute.new(key,value,self)
               end
             when :end_element
 -              tag_stack.pop
               @build_context = @build_context.parent
             when :text
               if @build_context[-1].instance_of? Text
 diff --git a/lib/rexml/rexml.rb b/lib/rexml/rexml.rb
 index 39e92a5..99d574b 100644
 --- a/lib/rexml/rexml.rb
 +++ b/lib/rexml/rexml.rb
@@ -31,7 +31,7 @@
 module REXML
   COPYRIGHT = "Copyright © 2001-2008 Sean Russell <ser@germane-software.com>"
   DATE = "2008/019"
 -  VERSION = "3.3.3"
 +  VERSION = "3.3.6"
   REVISION = ""
   Copyright = COPYRIGHT
 -- 
 2.27.0
--- a/backport-CVE-2024-47220.patch
+++ b/backport-CVE-2024-47220.patch
@ -0,0 +1,62 @@
 From f5faca9222541591e1a7c3c97552ebb0c92733c7 Mon Sep 17 00:00:00 2001
 From: Jeremy Evans <code@jeremyevans.net>
 Date: Wed, 18 Sep 2024 14:11:49 -0700
 Subject: [PATCH] Prevent request smuggling
 If a request has both a content-length and transfer-encoding
 headers, return a 400 response.  This is allowed by RFC 7230
 section 3.3.3.3.
 Fixes #145
 ---
 lib/webrick/httprequest.rb       |  4 ++++
 test/webrick/test_httprequest.rb | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)
 diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb
 index 5cf5844..820acb2 100644
 --- a/lib/webrick/httprequest.rb
 +++ b/lib/webrick/httprequest.rb
@@ -474,6 +474,10 @@ module WEBrick
     def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
 +        if self['content-length']
 +          raise HTTPStatus::BadRequest, "request with both transfer-encoding and content-length, possible request smuggling"
 +        end
 +
         case tc
         when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
 diff --git a/test/webrick/test_httprequest.rb b/test/webrick/test_httprequest.rb
 index 855ff9d..cce9b91 100644
 --- a/test/webrick/test_httprequest.rb
 +++ b/test/webrick/test_httprequest.rb
@@ -81,6 +81,24 @@ GET /
     }
   end
 +  def test_content_length_and_transfer_encoding_headers_smuggling
 +    msg = <<~HTTP.gsub("\n", "\r\n")
 +      POST /user HTTP/1.1
 +      Content-Length: 28
 +      Transfer-Encoding: chunked
 +
 +      0
 +
 +      GET /admin HTTP/1.1
 +
 +    HTTP
 +    req = WEBrick::HTTPRequest.new(WEBrick::Config::HTTP)
 +    req.parse(StringIO.new(msg))
 +    assert_raise(WEBrick::HTTPStatus::BadRequest){
 +      req.body
 +    }
 +  end
 +
   def test_parse_headers
     msg = <<-_end_of_message_
       GET /path HTTP/1.1
 -- 
 2.27.0
--- a/backport-CVE-2024-49761.patch
+++ b/backport-CVE-2024-49761.patch
@ -0,0 +1,38 @@
 From ce59f2eb1aeb371fe1643414f06618dbe031979f Mon Sep 17 00:00:00 2001
 From: Sutou Kouhei <kou@clear-code.com>
 Date: Thu, 24 Oct 2024 14:45:31 +0900
 Subject: [PATCH] parser: fix a bug that &#0x...; is accepted as a character
 reference
 diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
 index 7bd8adf..b4547ba 100644
 --- a/lib/rexml/parsers/baseparser.rb
 +++ b/lib/rexml/parsers/baseparser.rb
@@ -150,7 +150,7 @@ module REXML
         PEDECL_PATTERN = "\\s+(%)\\s+#{NAME}\\s+#{PEDEF}\\s*>"
         ENTITYDECL_PATTERN = /(?:#{GEDECL_PATTERN})|(?:#{PEDECL_PATTERN})/um
         CARRIAGE_RETURN_NEWLINE_PATTERN = /\r\n?/
 -        CHARACTER_REFERENCES = /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/
 +        CHARACTER_REFERENCES = /&#((?:\d+)|(?:x[a-fA-F0-9]+));/
         DEFAULT_ENTITIES_PATTERNS = {}
         default_entities = ['gt', 'lt', 'quot', 'apos', 'amp']
         default_entities.each do |term|
@@ -570,8 +570,12 @@ module REXML
         return rv if matches.size == 0
         rv.gsub!( Private::CHARACTER_REFERENCES ) {
           m=$1
 -          m = "0#{m}" if m[0] == ?x
 -          [Integer(m)].pack('U*')
 +          if m.start_with?("x")
 +            code_point = Integer(m[1..-1], 16)
 +          else
 +            code_point = Integer(m, 10)
 +          end
 +          [code_point].pack('U*')
         }
         matches.collect!{|x|x[0]}.compact!
         if filter
 -- 
 2.27.0
--- a/ruby.spec
+++ b/ruby.spec
@ -1,6 +1,6 @@
 Name:      ruby
 Version:   2.5.8
-Release:   127
+Release:   132
 Summary:   Object-oriented scripting language interpreter
 License:   (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD
 URL:       https://www.ruby-lang.org/
@ -70,6 +70,13 @@ Patch6026: backport-0005-CVE-2024-35221.patch
 Patch6027: upgrade-lib-rexml-to-3.3.1.patch
 Patch6028: upgrade-lib-rexml-test-to-3.3.1.patch
 Patch6029: backport-CVE-2024-41946.patch
 Patch6030: backport-CVE-2024-39908-CVE-2024-41123-upgrade-lib-rexml-to-3.3.3.patch
 Patch6031: backport-CVE-2024-43398-upgrade-lib-rexml-to-3.3.6.patch
 Patch6032: backport-CVE-2024-47220.patch
 Patch6033: backport-CVE-2024-49761.patch
 Patch6034: backport-0001-CVE-2021-41817.patch
 Patch6035: backport-0002-CVE-2021-41817.patch
 Patch6036: backport-0003-CVE-2021-41817.patch
 Patch9000: add-require_relative-helper-to-uninitialized-constan.patch
@ -145,7 +152,7 @@ The irb is acronym for Interactive Ruby,It evaluates ruby expression from the te
 %package -n rubygem-rdoc
 Summary:    Generate HTML and command-line documentation for Ruby projects
 Version:    6.0.1.1
-License:    GPLv2 and Ruby and MIT and OFL
+License:    GPLv2 and Ruby and MIT and OFL-1.1-RFN
 Requires:   ruby(release) ruby(rubygems) >= 2.7.6 ruby(irb) = 2.5.8 rubygem(io-console) >= 0.4.6 rubygem(json) >= 2.1.0
 Provides:   rdoc = %{version}-%{release} ri = %{version}-%{release} rubygem(rdoc) = %{version}-%{release}
 BuildArch:  noarch
@ -609,6 +616,21 @@ make runruby TESTRUN_SCRIPT=%{SOURCE13}
 %exclude %{gem_dir}/gems/xmlrpc-0.3.0/.*
 %changelog
 * Thu Dec 19 2024 shixuantong <shixuantong1@huawei.com> - 2.5.8-132
 - fix CVE-2021-41817
 * Tue Oct 29 2024 shixuantong <shixuantong1@huawei.com> - 2.5.8-131
 - fix CVE-2024-49761
 * Tue Oct 08 2024 shixuantong <shixuantong1@huawei.com> - 2.5.8-130
 - fix CVE-2024-47220
 * Mon Sep 02 2024 shixuantong <shixuantong1@huawei.com> - 2.5.8-129
 - upgrade rexml to fix CVE-2024-39908 CVE-2024-41123 CVE-2024-43398
 * Fri Aug 30 2024 shixuantong <shixuantong1@huawei.com> - 2.5.8-128
 - license compliance rectification
 * Fri Aug 09 2024 zhangxianting <zhangxianting@uniontech.com> - 2.5.8-127
 - fix CVE-2024-41946
Author	SHA1	Message	Date
openeuler-ci-bot	306ae88e6c	!231 fix CVE-2021-41817 From: @tong_1001 Reviewed-by: @shinwell_hu, @shenyangyang01 Signed-off-by: @shenyangyang01	2024-12-23 09:07:28 +00:00
shixuantong	5cf8152653	fix CVE-2021-41817	2024-12-19 17:07:07 +08:00
openeuler-ci-bot	003690f1a9	!225 fix CVE-2024-49761 From: @tong_1001 Reviewed-by: @shinwell_hu Signed-off-by: @shinwell_hu	2024-10-30 10:04:02 +00:00
shixuantong	0bbee328ec	fix CVE-2024-49761	2024-10-29 19:39:08 +08:00
openeuler-ci-bot	198ccb365e	!215 fix CVE-2024-47220 From: @tong_1001 Reviewed-by: @shinwell_hu Signed-off-by: @shinwell_hu	2024-10-08 10:05:10 +00:00
shixuantong	6bad86a0b4	fix CVE-2024-47220	2024-10-08 14:25:33 +08:00
openeuler-ci-bot	7fbb4c1d7c	!212 upgrade rexml to fix CVE-2024-39908 CVE-2024-41123 CVE-2024-43398 From: @tong_1001 Reviewed-by: @openeuler-basic Signed-off-by: @openeuler-basic	2024-09-03 06:38:46 +00:00
shixuantong	92299a72a1	upgrade rexml to fix CVE-2024-39908 CVE-2024-41123 CVE-2024-43398	2024-09-02 16:48:52 +08:00
openeuler-ci-bot	34cc0f9669	!208 license compliance rectification From: @tong_1001 Reviewed-by: @small_leek Signed-off-by: @small_leek	2024-09-02 08:20:37 +00:00
shixuantong	86a915ec19	license compliance rectification	2024-08-30 15:00:15 +08:00