1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
Description: Fix CVE-2015-3451: expand_entities set to 0 is not preserved after a _clone() call
Origin: upstream, https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30,
https://bitbucket.org/shlomif/perl-xml-libxml/commits/915f1dbaf21c5f3c21d7c519c70fd93859e47152
Bug-Debian: https://bugs.debian.org/783443
Forwarded: not-needed
Author: Shlomi Fish <shlomif@shlomifish.org>
Last-Update: 2015-05-01
Applied-Upstream: 2.0120
--- a/LibXML.pm
+++ b/LibXML.pm
@@ -396,8 +396,11 @@ sub _clone {
line_numbers => $self->{XML_LIBXML_LINENUMBERS},
base_uri => $self->{XML_LIBXML_BASE_URI},
gdome => $self->{XML_LIBXML_GDOME},
- set_parser_flags => $self->{XML_LIBXML_PARSER_OPTIONS},
});
+ # The parser options may contain some options that were zeroed from the
+ # defaults so set_parser_flags won't work here. We need to assign them
+ # explicitly.
+ $new->{XML_LIBXML_PARSER_OPTIONS} = $self->{XML_LIBXML_PARSER_OPTIONS};
$new->input_callbacks($self->input_callbacks());
return $new;
}
--- a/t/43options.t
+++ b/t/43options.t
@@ -3,7 +3,7 @@
use strict;
use warnings;
-use Test::More tests => 289;
+use Test::More tests => 290;
use XML::LibXML;
@@ -125,6 +125,44 @@ no_network
}
{
+ my $XML = <<'EOT';
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE title [ <!ELEMENT title ANY >
+<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
+<rss version="2.0">
+<channel>
+ <link>example.com</link>
+ <description>XXE</description>
+ <item>
+ <title>&xxe;</title>
+ <link>example.com</link>
+ <description>XXE here</description>
+ </item>
+</channel>
+</rss>
+EOT
+
+ my $sys_line = <<'EOT';
+<title>&xxe;</title>
+EOT
+
+ chomp ($sys_line);
+
+ my $parser = XML::LibXML->new(
+ expand_entities => 0,
+ load_ext_dtd => 0,
+ no_network => 1,
+ expand_xinclude => 0,
+ );
+ my $XML_DOC = $parser->load_xml( string => $XML, );
+
+ # TEST
+ ok (scalar($XML_DOC->toString() =~ m{\Q$sys_line\E}),
+ "expand_entities is preserved after _clone()/etc."
+ );
+}
+
+{
my $p = XML::LibXML->new(map { $_=>1 } @all);
for my $opt (@all) {
# TEST*$all
|
