nyx/tests/fixtures/xxe/ruby/safe_xxe_nokogiri.rb
2026-05-07 01:29:31 -04:00

11 lines
426 B
Ruby

# Safe: Nokogiri ≥ 1.10 is XXE-safe by default; the canonical safe-options
# constant `Nokogiri::XML::ParseOptions::DEFAULT_XML` does not include
# NOENT / DTDLOAD / DTDATTR, so the gate's `dangerous_values` list does
# not match and the call is suppressed.
require "nokogiri"
def handle(params)
body = params["xml"]
doc = Nokogiri::XML(body, nil, "UTF-8", Nokogiri::XML::ParseOptions::DEFAULT_XML)
doc.root.text
end