You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
68 lines
2.5 KiB
68 lines
2.5 KiB
Index: gnome-vfs-2.24.2/imported/neon/ne_xml.c |
|
=================================================================== |
|
--- gnome-vfs-2.24.2/imported/neon/ne_xml.c (revision 1687) |
|
+++ gnome-vfs-2.24.2/imported/neon/ne_xml.c (revision 1688) |
|
@@ -405,6 +405,28 @@ |
|
destroy_element(elm); |
|
} |
|
|
|
+#if defined(HAVE_EXPAT) && XML_MAJOR_VERSION > 1 |
|
+/* Stop the parser if an entity declaration is hit. */ |
|
+static void entity_declaration(void *userData, const XML_Char *entityName, |
|
+ int is_parameter_entity, const XML_Char *value, |
|
+ int value_length, const XML_Char *base, |
|
+ const XML_Char *systemId, const XML_Char *publicId, |
|
+ const XML_Char *notationName) |
|
+{ |
|
+ ne_xml_parser *parser = userData; |
|
+ |
|
+ NE_DEBUG(NE_DBG_XMLPARSE, "XML: entity declaration [%s]. Failing.\n", |
|
+ entityName); |
|
+ |
|
+ XML_StopParser(parser->parser, XML_FALSE); |
|
+} |
|
+#elif defined(HAVE_EXPAT) |
|
+/* A noop default_handler. */ |
|
+static void default_handler(void *userData, const XML_Char *s, int len) |
|
+{ |
|
+} |
|
+#endif |
|
+ |
|
/* Find a namespace definition for 'prefix' in given element, where |
|
* length of prefix is 'pfxlen'. Returns the URI or NULL. */ |
|
static const char *resolve_nspace(const struct element *elm, |
|
@@ -459,14 +481,34 @@ |
|
XML_SetCharacterDataHandler(p->parser, char_data); |
|
XML_SetUserData(p->parser, (void *) p); |
|
XML_SetXmlDeclHandler(p->parser, decl_handler); |
|
+ |
|
+ /* Prevent the "billion laughs" attack against expat by disabling |
|
+ * internal entity expansion. With 2.x, forcibly stop the parser |
|
+ * if an entity is declared - this is safer and a more obvious |
|
+ * failure mode. With older versions, installing a noop |
|
+ * DefaultHandler means that internal entities will be expanded as |
|
+ * the empty string, which is also sufficient to prevent the |
|
+ * attack. */ |
|
+#if XML_MAJOR_VERSION > 1 |
|
+ XML_SetEntityDeclHandler(p->parser, entity_declaration); |
|
#else |
|
+ XML_SetDefaultHandler(p->parser, default_handler); |
|
+#endif |
|
+ |
|
+#else /* HAVE_LIBXML */ |
|
p->parser = xmlCreatePushParserCtxt(&sax_handler, |
|
(void *)p, NULL, 0, NULL); |
|
if (p->parser == NULL) { |
|
abort(); |
|
} |
|
+#if LIBXML_VERSION < 20602 |
|
p->parser->replaceEntities = 1; |
|
+#else |
|
+ /* Enable expansion of entities, and disable network access. */ |
|
+ xmlCtxtUseOptions(p->parser, XML_PARSE_NOENT | XML_PARSE_NONET); |
|
#endif |
|
+ |
|
+#endif /* HAVE_LIBXML || HAVE_EXPAT */ |
|
return p; |
|
} |
|
|
|
|