c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not fetch external parsed entities

Browse Source 
Unless explicietely asked for when validating or replacing entities
with their value. Problem pointed out by Tom Lane <tgl@redhat.com>

* parser.c: do not load external parsed entities unless needed
* test/errors/extparsedent.xml result/errors/extparsedent.xml*:
  add a regression test to avoid change of the behaviour in the future
This commit is contained in:
Daniel Veillard 2012-07-23 14:15:40 +08:00
parent baaf03f80f
commit 4629ee02ac
5 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
parser.c
View File

@ -6927,8 +6927,15 @@ xmlParseReference(xmlParserCtxtPtr ctxt) {
* The first reference to the entity trigger a parsing phase
* where the ent->children is filled with the result from
* the parsing.
* Note: external parsed entities will not be loaded, it is not
* required for a non-validating parser, unless the parsing option
* of validating, or substituting entities were given. Doing so is
* far more secure as the parser will only process data coming from
* the document entity by default.
*/
if (ent->checked == 0) {
if ((ent->checked == 0) &&
((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) ||
(ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) {
unsigned long oldnbent = ctxt->nbentities;
/*

5
result/errors/extparsedent.xml Normal file
View File

@ -0,0 +1,5 @@
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY c PUBLIC "bar" "/etc/doesnotexist">
]>
<root>&c;</root>

0
result/errors/extparsedent.xml.err Normal file
View File

0
result/errors/extparsedent.xml.str Normal file
View File

5
test/errors/extparsedent.xml Normal file
View File

@ -0,0 +1,5 @@
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY c PUBLIC "bar" "/etc/doesnotexist">
]>
<root>&c;</root>