rapid7/metasploit-framework — pull request #3405 by todb-r7 (2014-05-29 17:02:15+00:00)
Title: Be more specific with Nokogiri check

There are still strong reservations about using Nokogiri to parse untrusted XML data.

http://www.wireharbor.com/hidden-security-risks-of-xml-parsing-xxe-attack/

It is also believed that many desktop operating systems are still shipping out-of-date and vulnerable libxml2 libraries, which become exposed via Nokogiri. For example:

http://stackoverflow.com/questions/18627075/nokogiri-1-6-0-still-pulls-in-wrong-version-of-libxml-on-os-x

While this isn't a problem for binary builds of Metasploit (Metasploit Community, Express, or Pro) it can be a problem for development versions or Kali's / Backtrack's version.

So, the compromise here is to allow for modules that don't directly expose XML parsing. I can't say for sure that the various libxml2 vulnerabilities (current and future) aren't also exposed via `Nokogiri::HTML` but I also can't come up with a reasonable demo.

Metasploit committers should still look at any module that relies on Nokogiri very carefully, and suggest alternatives if there are any. But, it's sometimes going to be required for complex HTML parsing.

**tl;dr:** Use REXML for XML parsing, and Nokogiri for HTML parsing if you absolutely must.

## Verification

- [ ] Run `tools/msftidy.rb modules`
- [ ] Verify that there are no longer any Nokogiri errors.

cc @wvu-r7 @hmoore-r7 @jlee-r7 @limhoff-r7 for landing/comment if you care to.