External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 06:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

LSN-2014-0003: Don't expand entities when parsing XML

Browse Source 
If the XML_PARSE_NOENT flag is passed to libxml2, then any
entities in the input document will be fully expanded. This
allows the user to read arbitrary files on the host machine
by creating an entity pointing to a local file. Removing
the XML_PARSE_NOENT flag means that any entities are left
unchanged by the parser, or expanded to "" by the XPath
APIs.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit d6b27d3e4c)
This commit is contained in:
Daniel P. Berrange 2014-04-15 11:20:29 +01:00 committed by Eric Blake
parent 4fb55871e9
commit 89538f57f4
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/util/virxml.c
View File

@ -747,11 +747,11 @@ virXMLParseHelper(int domcode,
if (filename) {
xml = xmlCtxtReadFile(pctxt, filename, NULL,
XML_PARSE_NOENT | XML_PARSE_NONET |
XML_PARSE_NONET |
XML_PARSE_NOWARNING);
} else {
xml = xmlCtxtReadDoc(pctxt, BAD_CAST xmlStr, url, NULL,
XML_PARSE_NOENT | XML_PARSE_NONET |
XML_PARSE_NONET |
XML_PARSE_NOWARNING);
}
if (!xml)