ckruse/CFPropertyList

Any specific reason to use NOENT?

Closed this issue · 4 comments

shubhampathak commented

@ckruse Hi Christian, found NOENT in both rbLibXMLParser.rb and rbNokogiriParser.rb
Passing NOENT as parsing option is risky.

Passing NOENT (which is used to substitute entities) as parsing options permits processing of entities, including both regular and external. That means NONET and NODTDLOAD will be of no use if NOENT is there.

Take a look at this:
sparklemotion/nokogiri#1582 (comment)

This is why Nokogiri team strictly suggests using default parsing options:
DEFAULT_XML = RECOVER | NONET

NOENT

ckruse commented

Hm. I actually don't remember anymore. It is several years ago that I wrote this code. Following the links you posted it seems to make sense to disable it. Do you mind to create a pull request?

shubhampathak commented

Hi Christian, thanks for the quick response. Sure! creating a Pull Request.

  • ❤️1
ckruse commented

fixed by #56

ckruse commented

I pushed a new version

  • 🎉1