From d5d9ca16e05c531d6b7d0a8c93816bceb0302845 Mon Sep 17 00:00:00 2001
From: James Mason <jmason@suse.com>
Date: Tue, 10 Oct 2017 10:34:16 -0700
Subject: [PATCH] Require a version of nokogiri with known vulnerabilities
 resolved

re: https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/b532fbd10b687d
---
 Gemfile      | 5 +++++
 Gemfile.lock | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/Gemfile b/Gemfile
index 7f25aa46..22dc5f6e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -200,6 +200,11 @@ gem 'sprockets-rails'
 # for multiple speakers select on proposal/event forms
 gem 'selectize-rails'
 
+# Nokogiri < 1.8.1 is subject to:
+# CVE-2017-0663, CVE-2017-7375, CVE-2017-7376, CVE-2017-9047, CVE-2017-9048,
+# CVE-2017-9049, CVE-2017-9050
+gem 'nokogiri', '>= 1.8.1'
+
 # Use guard and spring for testing in development
 group :development do
   # to launch specs when files are modified
diff --git a/Gemfile.lock b/Gemfile.lock
index c6b4faa8..c140ffdf 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -290,7 +290,7 @@ GEM
     mysql2 (0.4.9)
     nenv (0.3.0)
     netrc (0.11.0)
-    nokogiri (1.8.0)
+    nokogiri (1.8.1)
       mini_portile2 (~> 2.2.0)
     notiffany (0.1.1)
       nenv (~> 0.1)