security advisories

metanorma · Aug 22, 2024 · f9bf84f · f9bf84f
1 parent a173c7c
commit f9bf84f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/lib/html2doc/mime.rb b/lib/html2doc/mime.rb
@@ -48,7 +48,7 @@ def mime_type(item)
   end
 
   def mime_boundary
-    salt = UUIDTools::UUID.random_create.to_s.gsub(/-/, ".")[0..17]
+    salt = UUIDTools::UUID.random_create.to_s.tr("-", ".")[0..17]
     "----=_NextPart_#{salt}"
   end
 
@@ -67,10 +67,10 @@ def mime_package(result, filename, dir)
   end
 
   def contentid(mhtml)
-    mhtml.gsub %r{(<img[^>]*?src=")([^"']+)(['"])}m do |m|
+    mhtml.gsub %r{(<img[^>]*?src=")([^"'<]+)(['"])}m do |m|
       repl = "#{$1}cid:#{File.basename($2)}#{$3}"
       /^data:|^https?:/ =~ $2 ? m : repl
-    end.gsub %r{(<v:imagedata[^>]*?src=")([^"']+)(['"])}m do |m|
+    end.gsub %r{(<v:imagedata[^>]*?src=")([^"'<]+)(['"])}m do |m|
       repl = "#{$1}cid:#{File.basename($2)}#{$3}"
       /^data:|^https?:/ =~ $2 ? m : repl
     end

diff --git a/lib/html2doc/xml.rb b/lib/html2doc/xml.rb
@@ -8,12 +8,12 @@ class Html2Doc
   HERE
 
   def to_xhtml(xml)
-    xml.gsub!(/<\?xml[^>]*>/, "")
+    xml.gsub!(/<\?xml[^<>]*>/, "")
     unless /<!DOCTYPE /.match? xml
       xml = '<!DOCTYPE html SYSTEM
           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">' + xml
     end
-    xml = xml.gsub(/<!--\s*\[([^\]]+)\]>/, "<!-- MSWORD-COMMENT \\1 -->")
+    xml = xml.gsub(/<!--\s*\[([^\<\]]+)\]>/, "<!-- MSWORD-COMMENT \\1 -->")
       .gsub(/<!\s*\[endif\]\s*-->/, "<!-- MSWORD-COMMENT-END -->")
     Nokogiri::XML.parse(xml)
   end
@@ -38,7 +38,7 @@ def msword_fix(doc)
               '<span style="mso-special-character:footnote"></span>')
     doc.gsub!(%r{<div style="mso-element:footnote-list"></div>},
               '<div style="mso-element:footnote-list"/>')
-    doc.gsub!(%r{(<a style="mso-comment-reference:[^>/]+)/>}, "\\1></a>")
+    doc.gsub!(%r{(<a style="mso-comment-reference:[^<>/]+)/>}, "\\1></a>")
     doc.gsub!(%r{<link rel="File-List"}, "<link rel=File-List")
     doc.gsub!(%r{<meta http-equiv="Content-Type"},
               "<meta http-equiv=Content-Type")