87c5ae13cf
Enable DTD loading and entity resolution in yelp-build and yelp-check XML parsers so that DocBook 4 SYSTEM entity declarations are processed correctly. Also harden PathResolver against XXE file disclosure by validating that resolved paths remain within the source directory. Resolves: RHEL-46281
24 lines
981 B
Diff
24 lines
981 B
Diff
--- a/tools/yelp-build.in
|
|
+++ b/tools/yelp-build.in
|
|
@@ -285,7 +285,7 @@
|
|
return None
|
|
|
|
def get_xml(self, infile, path):
|
|
- parser = lxml.etree.XMLParser()
|
|
+ parser = lxml.etree.XMLParser(load_dtd=True, resolve_entities=True, no_network=True)
|
|
parser.resolvers.add(PathResolver(os.path.realpath(infile.absdir), path))
|
|
tree = lxml.etree.parse(infile.absfile, parser=parser)
|
|
def pathloader(href, parse, encoding=None):
|
|
--- a/tools/yelp-check.in
|
|
+++ b/tools/yelp-check.in
|
|
@@ -234,7 +234,8 @@
|
|
def get_xml(self, xmlfile):
|
|
# FIXME: we can cache these if we add a feature to run multiple
|
|
# checkers at once
|
|
- tree = lxml.etree.parse(xmlfile.absfile)
|
|
+ parser = lxml.etree.XMLParser(load_dtd=True, resolve_entities=True, no_network=True)
|
|
+ tree = lxml.etree.parse(xmlfile.absfile, parser=parser)
|
|
if self.xinclude:
|
|
lxml.etree.XInclude()(tree.getroot())
|
|
return tree
|