diff options
Diffstat (limited to 'dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch')
| -rw-r--r-- | dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch | 72 |
1 files changed, 72 insertions, 0 deletions
diff --git a/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch new file mode 100644 index 000000000000..8be7783ef679 --- /dev/null +++ b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch @@ -0,0 +1,72 @@ +From 05749ae525317d05bd9d4232c080e530854f1d88 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com> +Date: Fri, 30 Sep 2016 14:31:26 +0200 +Subject: [PATCH] Do not enable expanding entities by default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Expanding external entity is insecure. +<https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing>. +This patch makes expand_entities option disabled by default. + +CPAN RT#118032 + +Signed-off-by: Petr Písař <ppisar@redhat.com> +--- + LibXML.pm | 2 +- + docs/libxml.dbk | 2 +- + t/43options.t | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/LibXML.pm b/LibXML.pm +index eb3cbd6..9ab4748 100644 +--- a/LibXML.pm ++++ b/LibXML.pm +@@ -261,7 +261,7 @@ use constant { + HTML_PARSE_NOERROR => (1<<5), # suppress error reports + }; + +-$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD | XML_PARSE_NOENT ); ++$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD ); + + # this hash is made global so that applications can add names for new + # libxml2 parser flags as temporary workaround +diff --git a/docs/libxml.dbk b/docs/libxml.dbk +index 30f279b..2c6674b 100644 +--- a/docs/libxml.dbk ++++ b/docs/libxml.dbk +@@ -1676,7 +1676,7 @@ local $XML::LibXML::setTagCompression = 1;</programlisting> + <term>expand_entities</term> + <listitem> + <para>/parser, reader/</para> +- <para>substitute entities; possible values are 0 and 1; default is 1</para> ++ <para>substitute entities; possible values are 0 and 1; default is 0</para> + <para>Note that although this flag disables entity substitution, it + does not prevent the parser from loading external entities; + when substitution of an external entity is disabled, the +diff --git a/t/43options.t b/t/43options.t +index 826f0ad..53dd35e 100644 +--- a/t/43options.t ++++ b/t/43options.t +@@ -50,7 +50,7 @@ no_network + { + my $p = XML::LibXML->new(); + for my $opt (@all) { +- my $ret = (($opt =~ /^(?:load_ext_dtd|expand_entities)$/) ? 1 : 0); ++ my $ret = (($opt =~ /^(?:load_ext_dtd)$/) ? 1 : 0); + # TEST*$all + ok( + ($p->get_option($opt)||0) == $ret +@@ -110,7 +110,7 @@ no_network + ok( $p->get_option('recover') == 2, ' TODO : Add test name' ); + + # TEST +- ok( $p->expand_entities() == 1, ' TODO : Add test name' ); ++ ok( $p->expand_entities() == 0, ' TODO : Add test name' ); + # TEST + ok( $p->load_ext_dtd() == 1, ' TODO : Add test name' ); + $p->load_ext_dtd(0); +-- +2.7.4 + |