From d868348fac40ff8688f19725040cac4160126313 Mon Sep 17 00:00:00 2001 From: mae Date: Sat, 5 Aug 2023 14:29:29 +0200 Subject: [PATCH] Completely disable xml entity resolution --- CHANGELOG.md | 2 +- lib/pleroma/web/xml.ex | 2 +- test/fixtures/xml_billion_laughs.xml | 15 +++++++++++++++ test/pleroma/web/xml_test.exs | 5 +++++ 4 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 test/fixtures/xml_billion_laughs.xml diff --git a/CHANGELOG.md b/CHANGELOG.md index d02836c9a..6e26a2a83 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,7 +39,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## Security - Add `no_new_privs` hardening to OpenRC and systemd service files -- Ensured that XML parsers cannot load external entities (thanks @Mae@is.badat.dev!) +- XML parsers cannot load any entities (thanks @Mae@is.badat.dev!) - Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories ## Removed diff --git a/lib/pleroma/web/xml.ex b/lib/pleroma/web/xml.ex index 4151e00f5..ba8886548 100644 --- a/lib/pleroma/web/xml.ex +++ b/lib/pleroma/web/xml.ex @@ -31,7 +31,7 @@ def parse_document(text) do |> :binary.bin_to_list() |> :xmerl_scan.string( quiet: true, - fetch_fun: fn _, _ -> raise "Resolving external entities not supported" end + allow_entities: false ) {:ok, doc} diff --git a/test/fixtures/xml_billion_laughs.xml b/test/fixtures/xml_billion_laughs.xml new file mode 100644 index 000000000..75fb24cae --- /dev/null +++ b/test/fixtures/xml_billion_laughs.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + +]> +&lol9; diff --git a/test/pleroma/web/xml_test.exs b/test/pleroma/web/xml_test.exs index 89d4709b6..49306430b 100644 --- a/test/pleroma/web/xml_test.exs +++ b/test/pleroma/web/xml_test.exs @@ -3,6 +3,11 @@ defmodule Pleroma.Web.XMLTest do alias Pleroma.Web.XML + test "refuses to parse any entities from XML" do + data = File.read!("test/fixtures/xml_billion_laughs.xml") + assert(:error == XML.parse_document(data)) + end + test "refuses to load external entities from XML" do data = File.read!("test/fixtures/xml_external_entities.xml") assert(:error == XML.parse_document(data))