shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-12-25 23:21:26 +03:00
Code

Don't read external entities or XIncludes from stdin

Browse Source 
The file input callbacks try to read from stdin if "-" is passed as URL.
This should never be done when loading indirect resources like external
entities or XIncludes. Unfortunately, the stdin substitution happens
deep inside the IO code, so we simply replace "-" with "./-" in specific
locations.

This issue also affects other users of the library like libxslt.
Ideally, stdin should only be substituted on explicit request. But more
intrusive changes could break existing code.

Closes #90 and #102.
This commit is contained in:
Nick Wellnhofer 2019-09-20 12:44:17 +02:00
parent 6705f4d28e
commit e91cbcf639
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
parser.c
View File

@ -14004,6 +14004,10 @@ xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
ctxt->input_id = pctx->input_id + 1;
}
/* Don't read from stdin. */
if (xmlStrcmp(URL, BAD_CAST "-") == 0)
URL = BAD_CAST "./-";
uri = xmlBuildURI(URL, base);
if (uri == NULL) {

8
xinclude.c
View File

@ -449,6 +449,10 @@ xmlXIncludeParseFile(xmlXIncludeCtxtPtr ctxt, const char *URL) {
xmlCtxtUseOptions(pctxt, ctxt->parseFlags | XML_PARSE_DTDLOAD);
/* Don't read from stdin. */
if ((URL != NULL) && (strcmp(URL, "-") == 0))
URL = "./-";
inputStream = xmlLoadExternalEntity(URL, NULL, pctxt);
if (inputStream == NULL) {
xmlFreeParserCtxt(pctxt);
@ -1806,6 +1810,10 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, int nr) {
xmlParserInputPtr inputStream;
int xinclude_multibyte_fallback_used = 0;
/* Don't read from stdin. */
if (xmlStrcmp(url, BAD_CAST "-") == 0)
url = BAD_CAST "./-";
/*
* Check the URL and remove any fragment identifier
*/