Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
PyPy
pypy
Commits
bacb519b8262
Commit
bb79f00a
authored
Mar 04, 2021
by
Matti Picus
Browse files
port fixes for bpo-42051 reject XML entity declarations in plist files
parent
85bd018c69da
Changes
2
Hide whitespace changes
Inline
Side-by-side
lib-python/2.7/plistlib.py
View file @
bacb519b
...
...
@@ -403,9 +403,16 @@ class PlistParser:
parser
.
StartElementHandler
=
self
.
handleBeginElement
parser
.
EndElementHandler
=
self
.
handleEndElement
parser
.
CharacterDataHandler
=
self
.
handleData
parser
.
EntityDeclHandler
=
self
.
handleEntityDecl
parser
.
ParseFile
(
fileobj
)
return
self
.
root
def
handleEntityDecl
(
self
,
entity_name
,
is_parameter_entity
,
value
,
base
,
system_id
,
public_id
,
notation_name
):
# Reject plist files with entity declarations to avoid XML vulnerabilies in expat.
# Regular plist files don't contain those declerations, and Apple's plutil tool does not
# accept them either.
raise
ValueError
(
"XML entity declarations are not supported in plist files"
)
def
handleBeginElement
(
self
,
element
,
attrs
):
self
.
data
=
[]
handler
=
getattr
(
self
,
"begin_"
+
element
,
None
)
...
...
lib-python/2.7/test/test_plistlib.py
View file @
bacb519b
...
...
@@ -86,6 +86,18 @@ TESTDATA = """<?xml version="1.0" encoding="UTF-8"?>
</plist>
"""
.
replace
(
" "
*
8
,
"
\t
"
)
# Apple as well as plistlib.py output hard tabs
XML_PLIST_WITH_ENTITY
=
b
'''
\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd" [
<!ENTITY entity "replacement text">
]>
<plist version="1.0">
<dict>
<key>A</key>
<string>&entity;</string>
</dict>
</plist>
'''
class
TestPlistlib
(
unittest
.
TestCase
):
...
...
@@ -195,6 +207,10 @@ class TestPlistlib(unittest.TestCase):
self
.
assertEqual
(
test1
,
result1
)
self
.
assertEqual
(
test2
,
result2
)
def
test_xml_plist_with_entity_decl
(
self
):
with
self
.
assertRaisesRegex
(
plistlib
.
InvalidFileException
,
"XML entity declarations are not supported"
):
plistlib
.
loads
(
XML_PLIST_WITH_ENTITY
,
fmt
=
plistlib
.
FMT_XML
)
def
test_main
():
test_support
.
run_unittest
(
TestPlistlib
)
...
...
Matti Picus
@mattip
mentioned in commit
042d8b68d17c
·
Mar 07, 2021
mentioned in commit
042d8b68d17c
mentioned in commit fcd58159cdffe1fe57eddf2ab0fb54bcb22897e6
Toggle commit list
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment