mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

bpo-42051: Reject XML entity declarations in plist files (GH-22760)

Browse source 
(cherry picked from commit 05ee790f4d)

Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>
This commit is contained in:
Miss Skeleton (bot) 2020-10-19 19:34:37 -07:00 • committed by GitHub
parent e43bee7e11
commit 479553c7c1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Lib/plistlib.py
View file

@ -173,9 +173,16 @@ class _PlistParser:
self.parser.StartElementHandler = self.handle_begin_element
self.parser.EndElementHandler = self.handle_end_element
self.parser.CharacterDataHandler = self.handle_data
self.parser.EntityDeclHandler = self.handle_entity_decl
self.parser.ParseFile(fileobj)
return self.root
def handle_entity_decl(self, entity_name, is_parameter_entity, value, base, system_id, public_id, notation_name):
# Reject plist files with entity declarations to avoid XML vulnerabilies in expat.
# Regular plist files don't contain those declerations, and Apple's plutil tool does not
# accept them either.
raise InvalidFileException("XML entity declarations are not supported in plist files")
def handle_begin_element(self, element, attrs):
self.data = []
handler = getattr(self, "begin_" + element, None)