Require as little of REXML as possible to apply the entity_expansion_limit fix

1 files changed, 29 insertions, 24 deletions

diff --git a/activesupport/lib/active_support/core_ext/rexml.rb b/activesupport/lib/active_support/core_ext/rexml.rb
index d19d75d964..b4891a9153 100644
--- a/activesupport/lib/active_support/core_ext/rexml.rb
+++ b/activesupport/lib/active_support/core_ext/rexml.rb
@@ -1,34 +1,39 @@
-require 'rexml/document'
-require 'rexml/entity'
-
 # Fixes the rexml vulnerability disclosed at:
 # http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
 # This fix is identical to rexml-expansion-fix version 1.0.1
+require 'rexml/rexml'
 
 # Earlier versions of rexml defined REXML::Version, newer ones REXML::VERSION
-unless REXML::Document.respond_to?(:entity_expansion_limit=)
-  module REXML
-    class Entity < Child
-      undef_method :unnormalized
-      def unnormalized
-        document.record_entity_expansion! if document
-        v = value()
-        return nil if v.nil?
-        @unnormalized = Text::unnormalize(v, parent)
-        @unnormalized
-      end
-    end
-    class Document < Element
-      @@entity_expansion_limit = 10_000
-      def self.entity_expansion_limit= val
-        @@entity_expansion_limit = val
+unless (defined?(REXML::VERSION) ? REXML::VERSION : REXML::Version) > "3.1.7.2"
+  require 'rexml/document'
+
+  # REXML in 1.8.7 has the patch but didn't update Version from 3.1.7.2.
+  unless REXML::Document.respond_to?(:entity_expansion_limit=)
+    require 'rexml/entity'
+
+    module REXML
+      class Entity < Child
+        undef_method :unnormalized
+        def unnormalized
+          document.record_entity_expansion! if document
+          v = value()
+          return nil if v.nil?
+          @unnormalized = Text::unnormalize(v, parent)
+          @unnormalized
+        end
       end
+      class Document < Element
+        @@entity_expansion_limit = 10_000
+        def self.entity_expansion_limit= val
+          @@entity_expansion_limit = val
+        end
 
-      def record_entity_expansion!
-        @number_of_expansions ||= 0
-        @number_of_expansions += 1
-        if @number_of_expansions > @@entity_expansion_limit
-          raise "Number of entity expansions exceeded, processing aborted."
+        def record_entity_expansion!
+          @number_of_expansions ||= 0
+          @number_of_expansions += 1
+          if @number_of_expansions > @@entity_expansion_limit
+            raise "Number of entity expansions exceeded, processing aborted."
+          end
         end
       end
     end