Commit bb79f00a authored by Matti Picus's avatar Matti Picus

port fixes for bpo-42051 reject XML entity declarations in plist files

parent 85bd018c69da
......@@ -403,9 +403,16 @@ class PlistParser:
parser.StartElementHandler = self.handleBeginElement
parser.EndElementHandler = self.handleEndElement
parser.CharacterDataHandler = self.handleData
parser.EntityDeclHandler = self.handleEntityDecl
parser.ParseFile(fileobj)
return self.root
def handleEntityDecl(self, entity_name, is_parameter_entity, value, base, system_id, public_id, notation_name):
# Reject plist files with entity declarations to avoid XML vulnerabilies in expat.
# Regular plist files don't contain those declerations, and Apple's plutil tool does not
# accept them either.
raise ValueError("XML entity declarations are not supported in plist files")
def handleBeginElement(self, element, attrs):
self.data = []
handler = getattr(self, "begin_" + element, None)
......
......@@ -86,6 +86,18 @@ TESTDATA = """<?xml version="1.0" encoding="UTF-8"?>
</plist>
""".replace(" " * 8, "\t") # Apple as well as plistlib.py output hard tabs
XML_PLIST_WITH_ENTITY=b'''\
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd" [
<!ENTITY entity "replacement text">
]>
<plist version="1.0">
<dict>
<key>A</key>
<string>&entity;</string>
</dict>
</plist>
'''
class TestPlistlib(unittest.TestCase):
......@@ -195,6 +207,10 @@ class TestPlistlib(unittest.TestCase):
self.assertEqual(test1, result1)
self.assertEqual(test2, result2)
def test_xml_plist_with_entity_decl(self):
with self.assertRaisesRegex(plistlib.InvalidFileException,
"XML entity declarations are not supported"):
plistlib.loads(XML_PLIST_WITH_ENTITY, fmt=plistlib.FMT_XML)
def test_main():
test_support.run_unittest(TestPlistlib)
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment