Update nokogiri to 1.10.5

Description

We need to upgrade nokogiri to 1.10.5 due to CVE-2019-13117, CVE-2019-13118, and CVE-2019-18197.

The new version of nokogiri no longer reports the line number of an unclosed tag:

Fortunately for us, because of interactions with Sanitize, we close unclosed tags very late anyway, so there will be no changes from users' perspective.

How to test: confirm that imports still work and posting a work works as intended, similar to AO3-5181. Post a work with an unclosed HTML tag (e.g. em) and see if it gets auto-closed similarly to production.

Activity

Show:
redsummernight
November 29, 2019, 1:57 AM

The usual:

Posting a work with unclosed HTML tags:

On staging, the work content becomes:

That matches the behavior on beta:

Looks good.

james_
November 29, 2019, 9:16 PM
Edited

Imported a work https://test.archiveofourown.org/works/1071007

https://ao3testing.dreamwidth.org/3292.html

Posted a new chapter

This generated: https://test.archiveofourown.org/works/1071007/chapters/2140678

I am going ask people if they are happy I can see why it did it, sorry

redsummernight
November 29, 2019, 9:35 PM
Edited

In comparison, on beta:

So no regression here at least.

Assignee

Sarken

Reporter

redsummernight

Roadmap

Works

Priority

Medium

Affects versions

Fix versions

Components

Gems
Parser

Difficulty

Medium

Milestone

Internal 0.9
Configure