From f2b5c2627cb0f3f1b9690c6102e504ee2126fc18 Mon Sep 17 00:00:00 2001
From: James Mason <jmason@suse.com>
Date: Tue, 10 Oct 2017 10:34:16 -0700
Subject: [PATCH] Require a version of nokogiri with known vulnerabilities
 resolved

re: https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/b532fbd10b687d
---
 Gemfile      | 5 +++++
 Gemfile.lock | 9 +++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/Gemfile b/Gemfile
index 7f25aa46..22dc5f6e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -200,6 +200,11 @@ gem 'sprockets-rails'
 # for multiple speakers select on proposal/event forms
 gem 'selectize-rails'
 
+# Nokogiri < 1.8.1 is subject to:
+# CVE-2017-0663, CVE-2017-7375, CVE-2017-7376, CVE-2017-9047, CVE-2017-9048,
+# CVE-2017-9049, CVE-2017-9050
+gem 'nokogiri', '>= 1.8.1'
+
 # Use guard and spring for testing in development
 group :development do
   # to launch specs when files are modified
diff --git a/Gemfile.lock b/Gemfile.lock
index c6b4faa8..dc730e82 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -270,7 +270,7 @@ GEM
       open4 (~> 1.3.4)
       rake
     mini_magick (4.5.1)
-    mini_portile2 (2.2.0)
+    mini_portile2 (2.3.0)
     minitest (5.10.2)
     momentjs-rails (2.8.1)
       railties (>= 3.1)
@@ -290,8 +290,8 @@ GEM
     mysql2 (0.4.9)
     nenv (0.3.0)
     netrc (0.11.0)
-    nokogiri (1.8.0)
-      mini_portile2 (~> 2.2.0)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
     notiffany (0.1.1)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -609,6 +609,7 @@ DEPENDENCIES
   mini_magick
   money-rails
   mysql2
+  nokogiri (>= 1.8.1)
   omniauth
   omniauth-facebook
   omniauth-github
@@ -662,4 +663,4 @@ DEPENDENCIES
   whenever
 
 BUNDLED WITH
-   1.15.1
+   1.15.4