From 87c5ae13cfa14f6c3855f2f6470e4a948c1ef93a Mon Sep 17 00:00:00 2001
From: Radek Duda <rduda@redhat.com>
Date: Tue, 4 Aug 2026 17:49:03 +0200
Subject: [PATCH] Fix entity resolution for DocBook 4 SYSTEM entities

Enable DTD loading and entity resolution in yelp-build and yelp-check
XML parsers so that DocBook 4 SYSTEM entity declarations are processed
correctly. Also harden PathResolver against XXE file disclosure by
validating that resolved paths remain within the source directory.

Resolves: RHEL-46281
---
 yelp-fix-entity-resolution.patch   | 23 +++++++++++++++++++++++
 yelp-harden-xxe-pathresolver.patch | 16 ++++++++++++++++
 yelp-tools.spec                    |  9 ++++++++-
 3 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 yelp-fix-entity-resolution.patch
 create mode 100644 yelp-harden-xxe-pathresolver.patch

diff --git a/yelp-fix-entity-resolution.patch b/yelp-fix-entity-resolution.patch
new file mode 100644
index 0000000..e18edd2
--- /dev/null
+++ b/yelp-fix-entity-resolution.patch
@@ -0,0 +1,23 @@
+--- a/tools/yelp-build.in
++++ b/tools/yelp-build.in
+@@ -285,7 +285,7 @@
+         return None
+
+     def get_xml(self, infile, path):
+-        parser = lxml.etree.XMLParser()
++        parser = lxml.etree.XMLParser(load_dtd=True, resolve_entities=True, no_network=True)
+         parser.resolvers.add(PathResolver(os.path.realpath(infile.absdir), path))
+         tree = lxml.etree.parse(infile.absfile, parser=parser)
+         def pathloader(href, parse, encoding=None):
+--- a/tools/yelp-check.in
++++ b/tools/yelp-check.in
+@@ -234,7 +234,8 @@
+     def get_xml(self, xmlfile):
+         # FIXME: we can cache these if we add a feature to run multiple
+         # checkers at once
+-        tree = lxml.etree.parse(xmlfile.absfile)
++        parser = lxml.etree.XMLParser(load_dtd=True, resolve_entities=True, no_network=True)
++        tree = lxml.etree.parse(xmlfile.absfile, parser=parser)
+         if self.xinclude:
+             lxml.etree.XInclude()(tree.getroot())
+         return tree
diff --git a/yelp-harden-xxe-pathresolver.patch b/yelp-harden-xxe-pathresolver.patch
new file mode 100644
index 0000000..dd8cb24
--- /dev/null
+++ b/yelp-harden-xxe-pathresolver.patch
@@ -0,0 +1,16 @@
+--- a/tools/yelp-build.in
++++ b/tools/yelp-build.in
+@@ -147,7 +147,12 @@
+
+     def resolve(self, uri, id, context):
+         if os.path.exists(uri):
+-            return self.resolve_filename(uri, context)
++            realpath = os.path.realpath(uri)
++            if realpath.startswith(self.srcdir) or any(
++                realpath.startswith(os.path.realpath(p) + '/') for p in self.path
++            ):
++                return self.resolve_filename(uri, context)
++            return None
+         if uri.startswith(self.srcdir):
+             ref = uri[len(self.srcdir):]
+         else:
diff --git a/yelp-tools.spec b/yelp-tools.spec
index 0641c4e..27a7919 100644
--- a/yelp-tools.spec
+++ b/yelp-tools.spec
@@ -4,7 +4,7 @@
 
 Name:          yelp-tools
 Version:       42.1
-Release:       8%{?dist}
+Release:       9%{?dist}
 Summary:       Create, manage, and publish documentation for Yelp
 
 License:       GPL-2.0-or-later
@@ -14,6 +14,8 @@ BuildArch:     noarch
 
 # https://gitlab.gnome.org/GNOME/yelp-tools/-/merge_requests/12
 Patch:         url-handler.patch
+Patch:         yelp-fix-entity-resolution.patch
+Patch:         yelp-harden-xxe-pathresolver.patch
 
 BuildRequires: meson
 BuildRequires: pkgconfig(yelp-xsl)
@@ -64,6 +66,11 @@ wraps things up in a developer-friendly way.
 %{_datadir}/aclocal/yelp.m4
 
 %changelog
+* Fri Jul 31 2026 Radek Duda <rduda@redhat.com> - 42.1-9
+- Fix entity resolution for DocBook 4 SYSTEM entities
+- Harden PathResolver against XXE file disclosure
+  Resolves: RHEL-46281
+
 * Mon Jan 27 2025 Michael Catanzaro <mcatanzaro@redhat.com> - 42.1-8
 - Add URL handler to open help files in web browser
   Resolves: RHEL-76398