Commit bb79f00a authored by Matti Picus's avatar Matti Picus
Browse files

port fixes for bpo-42051 reject XML entity declarations in plist files

parent 85bd018c69da
......@@ -403,9 +403,16 @@ class PlistParser:
parser.StartElementHandler = self.handleBeginElement
parser.EndElementHandler = self.handleEndElement
parser.CharacterDataHandler = self.handleData
parser.EntityDeclHandler = self.handleEntityDecl
return self.root
def handleEntityDecl(self, entity_name, is_parameter_entity, value, base, system_id, public_id, notation_name):
# Reject plist files with entity declarations to avoid XML vulnerabilies in expat.
# Regular plist files don't contain those declerations, and Apple's plutil tool does not
# accept them either.
raise ValueError("XML entity declarations are not supported in plist files")
def handleBeginElement(self, element, attrs): = []
handler = getattr(self, "begin_" + element, None)
......@@ -86,6 +86,18 @@ TESTDATA = """<?xml version="1.0" encoding="UTF-8"?>
""".replace(" " * 8, "\t") # Apple as well as output hard tabs
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "" [
<!ENTITY entity "replacement text">
<plist version="1.0">
class TestPlistlib(unittest.TestCase):
......@@ -195,6 +207,10 @@ class TestPlistlib(unittest.TestCase):
self.assertEqual(test1, result1)
self.assertEqual(test2, result2)
def test_xml_plist_with_entity_decl(self):
with self.assertRaisesRegex(plistlib.InvalidFileException,
"XML entity declarations are not supported"):
plistlib.loads(XML_PLIST_WITH_ENTITY, fmt=plistlib.FMT_XML)
def test_main():
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment