1
0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-04-09 14:50:07 +03:00

418 Commits

Author SHA1 Message Date
Nick Wellnhofer
e880cf203a xpath: Fix parsing of non-ASCII names
Fix a long-standing issue where QNames starting with a non-ASCII
character would be rejected. This became more visible after "streaming"
XPath evaluation was disabled since the latter handled non-ASCII names
correctly.

Fixes #818.
2024-11-12 16:39:32 +01:00
Nick Wellnhofer
7f9419d484 parser: Fix detection of duplicate attributes
We really need a second scan if more than one namespace clash was
detected.
2024-11-12 16:39:15 +01:00
Nick Wellnhofer
8d42c447d6 parser: Fix namespaces redefined from default attributes
This regressed in commit e0dd330b.

Also fixes a long-standing issue where namespaces from default
attributes weren't added if they match an existing namespace.

Fixes #643.
2023-12-08 16:05:22 +01:00
Nick Wellnhofer
8672bf253b html: Reenable buggy detection of XML declarations
Switch to UTF-8 if a document starts with '<?xm' to match old behavior.
Also enable this check in the push parser.

Fixes #637.
2023-12-01 17:26:47 +01:00
Nick Wellnhofer
6ec42951cf parser: Make CRLF increment line number
Partial revert of cb927e85 fixing CRLFs not incrementing the line
number.

This requires to rework xmlParseQNameHashed. The original implementation
prompted the change to xmlCurrentChar which really shouldn't modify the
'cur' pointer as side effect. But the NEXTL macro relies on this
behavior.

Ultimately, we should reintroduce the change to xmlCurrentChar and fix
the NEXTL macro. This will lead to single CRs incrementing the line
number as well which seems more consistent.

Fixes #628.
2023-12-01 17:23:59 +01:00
Nick Wellnhofer
3fe3d50786 hash: Fix deletion of entries during scan
Functions like xmlCleanSpecialAttr scan a hash table and possibly delete
entries in the callback. xmlHashScanFull must detect such deletions and
rescan the entry.

This regressed when rewriting the hash table code in 4a513d56.

Fixes #626.
2023-11-23 16:20:54 +01:00
Nick Wellnhofer
7a2d412f68 parser: Copy default namespace in xmlParseBalancedChunkMemory 2023-10-31 20:19:27 +01:00
Nick Wellnhofer
e0c2f14d83 parser: Copy namespaces in xmlParseBalancedChunkMemory
Reenable copying of namespaces but don't set SAX data. This should
match the old behavior.
2023-10-31 14:04:57 +01:00
Nick Wellnhofer
b76d81dab3 parser: Fix regression when push parsing parameter entities
Short-lived regression from 834b8123.

Also shrink parameter entity buffers when push parsing.
2023-10-06 13:11:19 +02:00
Nick Wellnhofer
134d2ad890 parser: Protect against quadratic default attribute expansion 2023-10-06 12:47:24 +02:00
Nick Wellnhofer
0ba22c0513 parser: Support encoded external PEs in entity values
Corner case which was never supported.
2023-10-06 12:28:59 +02:00
Nick Wellnhofer
e48f3d8e0a tests: Add more tests for redefined attributes 2023-09-29 12:43:08 +02:00
Nick Wellnhofer
53050b1dd8 parser: More fixes to push parser error handling 2023-08-29 20:06:43 +02:00
Nick Wellnhofer
bbd918b2e7 parser: Fix detection of null bytes
Also suppress misleading extra errors.

Fixes #122.
2023-08-29 18:43:10 +02:00
Nick Wellnhofer
855818bd2b parser: Check for truncated multi-byte sequences
When decoding input data, check whether the "raw" buffer is empty after
parsing the document. Otherwise, the input ends with a truncated
multi-byte sequence which shouldn't be silently ignored.
2023-08-08 15:21:37 +02:00
Nick Wellnhofer
e4f85f1bd2 [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType
Fix a null pointer dereference when parsing (invalid) XML schemas.

Thanks to Robby Simpson for the report!

Fixes #491.
2023-04-11 14:29:50 +02:00
Nick Wellnhofer
d7d0bc6581 SAX2: Ignore namespaces in HTML documents
In commit 21ca8829, we started to ignore namespaces in HTML element
names but we still called xmlSplitQName, effectively stripping the
namespace prefix. This would cause elements like <o:p> being parsed
as <p>. Now we leave the name untouched.

Fixes #508.
2023-03-31 17:08:43 +02:00
Nick Wellnhofer
3f69fc805c parser: Tighten expansion limits
- Lower the amount of expansion which is always allowed from
  10MB to 1MB.
- Lower the maximum amplification factor from 10 to 5.
- Lower the "fixed cost" from 50 to 20.
2023-03-08 13:58:49 +01:00
Nick Wellnhofer
e20f4d7a65 xinclude: Fix quadratic behavior in xmlXIncludeLoadTxt
Also make text inclusions work with memory buffers, for example when
using a custom entity loader, and fix a memory leak in case of invalid
characters.

Fixes #483.
2023-02-14 12:25:07 +01:00
Nick Wellnhofer
608c65bb8e xpath: number('-') should return NaN
Fixes https://gitlab.gnome.org/GNOME/libxslt/-/issues/81
2023-01-18 15:15:41 +01:00
Nick Wellnhofer
d320a683d1 parser: Fix entity check in attributes
Don't set the "checked" flag when checking entities in default attribute
values. These entities could reference other entities which weren't
defined yet, so the check isn't reliable.

This fixes a short-lived regression which could lead to a call stack
overflow later in xmlStringGetNodeList.
2023-01-17 13:59:24 +01:00
Nick Wellnhofer
cfc036bda8 testrecurse: Test parameter entity accounting 2022-12-21 20:35:31 +01:00
Nick Wellnhofer
079da5b26d testrecurse: Add external entities to huge test 2022-12-21 20:21:51 +01:00
Nick Wellnhofer
01bcb23de1 testrecurse: Add test cases for external entities
Add test cases for external general and parameter entities.
2022-12-21 20:21:51 +01:00
Nick Wellnhofer
046f99c543 testrecurse: Add lol_param.xml
Add test case contributed by Sebastian Pipping for CVE-2021-3541.
2022-12-21 20:20:11 +01:00
Nick Wellnhofer
fafa025209 testrecurse: Rename test files 2022-12-21 20:20:11 +01:00
Nick Wellnhofer
ae0c9cfa05 uri: Fix handling of port numbers
Allow port number without host, real fix for #71.

Also compare port numbers in xmlBuildRelativeURI.

Fix handling of port numbers in xmlUriEscape.
2022-12-13 01:43:49 +01:00
Nick Wellnhofer
76c6da4209 error: Make sure that error messages are valid UTF-8
This has caused issues with the Python bindings for a long time.

Should fix #64.
2022-12-04 23:34:19 +01:00
Nick Wellnhofer
9c63cea5a6 test: Add test for push parser boundaries 2022-11-20 21:27:59 +01:00
Nick Wellnhofer
b456e3bb42 xinclude: Always allow XPtr expressions in external documents 2022-10-31 16:49:36 +01:00
Nick Wellnhofer
eef0a7395c xinclude: Implement "streaming" mode
When using xmlreader, XPointer expressions in XIncludes simply cannot
work. Expressions can reference nodes which weren't parsed yet or which
were already deleted.

After fixing nested XIncludes, we reference includes which were parsed
previously. When streaming, these nodes could have been deleted, leading
to use-after-free errors.

Disallow XPointer expressions and truncate the include table in
streaming mode.
2022-10-30 14:12:55 +01:00
Nick Wellnhofer
20e2fb4c1c xinclude: Avoid creation of subcontexts
Don't create subcontext in xmlXIncludeRecurseDoc. Save and restore 'doc'
and 'incTab' instead.

Make xmlXIncludeLoadFallback call xmlXIncludeCopyNode which seems safer
than xmlXIncludeDoProcess since the latter may modify the document.
This should also be more performant since we need to copy the whole
fallback subtree anyway. Also make sure to avoid replacements in
fallback elements in xmlXIncludeDoProcess.
2022-10-25 19:34:38 +02:00
Nick Wellnhofer
d2ed1e4f99 xinclude: Limit recursion depth
This avoids call stack overflows.
2022-10-23 18:52:56 +02:00
Nick Wellnhofer
34496f26db xinclude: Test for inclusion loops 2022-10-23 14:27:05 +02:00
Nick Wellnhofer
bc267cb9bc xinclude: Expand includes in xmlXIncludeCopyNode
This should make nested includes work reliably.

Fixes #424.
2022-10-23 14:27:05 +02:00
Nick Wellnhofer
c99cde3f21 xinclude: Also test error messages
The reader interface with XIncludes is somewhat broken and can generate
different error messages. Start to move tests which are sketchy with
reader to a separate directory.
2022-10-23 14:26:59 +02:00
Nick Wellnhofer
938105b572 Revert "xinclude: Fix regression with nested includes"
This reverts commit 7f04e297318b1b908cec20711f74f75625afed7f which
caused memory errors.

See #424.
2022-10-21 15:56:12 +02:00
Nick Wellnhofer
7f04e29731 xinclude: Fix regression with nested includes
This reverts commits 74dcc10b and 87d20b55.

Fixes #424.
2022-10-18 19:17:45 +02:00
Nick Wellnhofer
1d4f5d24ac schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK
Found by OSS-Fuzz.
2022-09-13 16:56:59 +02:00
Nick Wellnhofer
e986d09cf5 Skip incorrectly opened HTML comments
Commit 4fd69f3e fixed handling of '<' characters not followed by an
ASCII letter. But a '<!' sequence followed by invalid characters should
be treated as bogus comment and skipped.

Fixes #380.
2022-08-02 14:38:09 +02:00
Nick Wellnhofer
145170125a Fix parsing of subtracted regex character classes
Fixes #370.
2022-04-23 19:22:42 +02:00
Nick Wellnhofer
4612ce3031 Implement xpath1() XPointer scheme
See https://www.w3.org/2005/04/xpointer-schemes/
2022-04-21 04:26:52 +02:00
Nick Wellnhofer
41afa89fc9 Fix short-lived regression in xmlStaticCopyNode
Commit 7618a3b1 didn't account for coalesced text nodes.

I think it would be better if xmlStaticCopyNode didn't try to coalesce
text nodes at all. This code path can only be triggered if some other
code doesn't coalesce text nodes properly. In this case, OSS-Fuzz found
such behavior in xinclude.c.
2022-04-10 14:17:31 +02:00
Nick Wellnhofer
57b81c208c Normalize XPath strings in-place
Simplify the code and fix a potential memory leak.

Fixes #343.
2022-03-05 18:22:51 +01:00
Nick Wellnhofer
bc06a522c1 Fix recursion check in xinclude.c
Compare the included URL with the document's URL to detect local
inclusions.

Fixes #348.
2022-03-02 20:44:41 +01:00
Mike Dalessio
24cdc89006 test coverage for abruptly-closed comments
These establish baseline behavior so that the subsequent commit is
clear about the behavior it will modify.
2022-03-02 14:42:47 +00:00
Damjan Jovanovic
966b0f21c1 Add whitespace folding for some atomic data types that it's missing on.
XSD validation fails when some atomic types contain surrounding whitespace
even though XML Schema Part 2: Datatypes Second Edition, section 4.3.6
says they should be collapsed. Fix this.

(I am not sure whether the test is correct.)

Issue: #278
2022-03-02 14:05:51 +00:00
Nick Wellnhofer
ea6e8f998d Fix certain combinations of regex range quantifiers
Fix regex transitions that have both min/max and a counter. In this
case, we want to save the regex state before incrementing the counter.

Fixes #301 and the issue reported here:

https://mail.gnome.org/archives/xml/2016-April/msg00017.html
2022-02-28 16:56:02 +01:00
Nick Wellnhofer
382fb056b5 Fix range quantifier on subregex
Make sure to add counted exit transitions before other counter
transitions. Otherwise, we won't backtrack correctly.

Fixes #65.
2022-02-28 16:56:02 +01:00
Nick Wellnhofer
ce0871e15c Only warn on invalid redeclarations of predefined entities
Downgrade the error message to a warning since the error was ignored,
anyway. Also print the name of redeclared entity. For a proper fix that
also shows filename and line number of the invalid redeclaration, we'd
have to

- pass the parser context to the entity functions somehow, or
- make these functions return distinct error codes.

Partial fix for #308.
2022-02-20 21:49:04 +01:00