mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-09-16 14:29:05 -07:00
dev-perl/XML-LibXML: Disable expanding external entities by default, bug 594614
Patch by ppisar@redhat.com https://rt.cpan.org/Public/Bug/Display.html?id=118032 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838097 https://bugzilla.redhat.com/show_bug.cgi?id=1377996 Package-Manager: Portage-2.3.3, Repoman-2.3.1
This commit is contained in:
Andreas K. Hüttel
70
dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild
Normal file
70
dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild
Normal file
@@ -0,0 +1,70 @@
|
||||
# Copyright 1999-2016 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
# $Id$
|
||||
|
||||
EAPI=6
|
||||
|
||||
DIST_AUTHOR=SHLOMIF
|
||||
DIST_VERSION=2.0128
|
||||
DIST_EXAMPLES=("example/*")
|
||||
inherit perl-module
|
||||
|
||||
DESCRIPTION="Perl binding for libxml2"
|
||||
|
||||
SLOT="0"
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
|
||||
IUSE="test minimal"
|
||||
|
||||
RDEPEND="
|
||||
>=dev-perl/XML-SAX-0.120.0
|
||||
>=dev-libs/libxml2-2.6.21
|
||||
dev-perl/XML-SAX-Base
|
||||
>=dev-perl/XML-NamespaceSupport-1.70.0
|
||||
"
|
||||
DEPEND="${RDEPEND}
|
||||
virtual/perl-ExtUtils-MakeMaker
|
||||
test? (
|
||||
!minimal? (
|
||||
dev-perl/Test-LeakTrace
|
||||
)
|
||||
)
|
||||
"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${P}-disable-expanding.patch"
|
||||
)
|
||||
|
||||
src_compile() {
|
||||
export SKIP_SAX_INSTALL=1
|
||||
perl-module_src_compile
|
||||
}
|
||||
|
||||
src_test() {
|
||||
perl_rm_files t/pod.t t/style-trailing-space.t t/cpan-changes.t
|
||||
perl-module_src_test
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
pkg_update_parser add XML::LibXML::SAX::Parser
|
||||
pkg_update_parser add XML::LibXML::SAX
|
||||
}
|
||||
|
||||
pkg_postrm() {
|
||||
pkg_update_parser remove XML::LibXML::SAX::Parser
|
||||
pkg_update_parser remove XML::LibXML::SAX
|
||||
}
|
||||
|
||||
pkg_update_parser() {
|
||||
# pkg_update_parser [add|remove] $parser_module
|
||||
local action=$1
|
||||
local parser_module=$2
|
||||
|
||||
if [[ "$ROOT" = "/" ]] ; then
|
||||
einfo "Update Parser: $1 $2"
|
||||
perl -MXML::SAX -e "XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()" \
|
||||
|| ewarn "Update Parser: $1 $2 failed"
|
||||
else
|
||||
elog "To $1 $2 run:"
|
||||
elog "perl -MXML::SAX -e 'XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()'"
|
||||
fi
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
From 05749ae525317d05bd9d4232c080e530854f1d88 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
||||
Date: Fri, 30 Sep 2016 14:31:26 +0200
|
||||
Subject: [PATCH] Do not enable expanding entities by default
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Expanding external entity is insecure.
|
||||
<https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing>.
|
||||
This patch makes expand_entities option disabled by default.
|
||||
|
||||
CPAN RT#118032
|
||||
|
||||
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
||||
---
|
||||
LibXML.pm | 2 +-
|
||||
docs/libxml.dbk | 2 +-
|
||||
t/43options.t | 4 ++--
|
||||
3 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/LibXML.pm b/LibXML.pm
|
||||
index eb3cbd6..9ab4748 100644
|
||||
--- a/LibXML.pm
|
||||
+++ b/LibXML.pm
|
||||
@@ -261,7 +261,7 @@ use constant {
|
||||
HTML_PARSE_NOERROR => (1<<5), # suppress error reports
|
||||
};
|
||||
|
||||
-$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD | XML_PARSE_NOENT );
|
||||
+$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD );
|
||||
|
||||
# this hash is made global so that applications can add names for new
|
||||
# libxml2 parser flags as temporary workaround
|
||||
diff --git a/docs/libxml.dbk b/docs/libxml.dbk
|
||||
index 30f279b..2c6674b 100644
|
||||
--- a/docs/libxml.dbk
|
||||
+++ b/docs/libxml.dbk
|
||||
@@ -1676,7 +1676,7 @@ local $XML::LibXML::setTagCompression = 1;</programlisting>
|
||||
<term>expand_entities</term>
|
||||
<listitem>
|
||||
<para>/parser, reader/</para>
|
||||
- <para>substitute entities; possible values are 0 and 1; default is 1</para>
|
||||
+ <para>substitute entities; possible values are 0 and 1; default is 0</para>
|
||||
<para>Note that although this flag disables entity substitution, it
|
||||
does not prevent the parser from loading external entities;
|
||||
when substitution of an external entity is disabled, the
|
||||
diff --git a/t/43options.t b/t/43options.t
|
||||
index 826f0ad..53dd35e 100644
|
||||
--- a/t/43options.t
|
||||
+++ b/t/43options.t
|
||||
@@ -50,7 +50,7 @@ no_network
|
||||
{
|
||||
my $p = XML::LibXML->new();
|
||||
for my $opt (@all) {
|
||||
- my $ret = (($opt =~ /^(?:load_ext_dtd|expand_entities)$/) ? 1 : 0);
|
||||
+ my $ret = (($opt =~ /^(?:load_ext_dtd)$/) ? 1 : 0);
|
||||
# TEST*$all
|
||||
ok(
|
||||
($p->get_option($opt)||0) == $ret
|
||||
@@ -110,7 +110,7 @@ no_network
|
||||
ok( $p->get_option('recover') == 2, ' TODO : Add test name' );
|
||||
|
||||
# TEST
|
||||
- ok( $p->expand_entities() == 1, ' TODO : Add test name' );
|
||||
+ ok( $p->expand_entities() == 0, ' TODO : Add test name' );
|
||||
# TEST
|
||||
ok( $p->load_ext_dtd() == 1, ' TODO : Add test name' );
|
||||
$p->load_ext_dtd(0);
|
||||
--
|
||||
2.7.4
|
||||
|
||||
Reference in New Issue
Block a user