38 lines
1.5 KiB
Diff
38 lines
1.5 KiB
Diff
From 46de45d079ae2622660fe147cf237ee617cc461c Mon Sep 17 00:00:00 2001
|
|
From: "Daniel P. Berrange" <berrange@redhat.com>
|
|
Date: Tue, 15 Apr 2014 11:20:29 +0100
|
|
Subject: [PATCH] LSN-2014-0003: Don't expand entities when parsing XML
|
|
|
|
If the XML_PARSE_NOENT flag is passed to libxml2, then any
|
|
entities in the input document will be fully expanded. This
|
|
allows the user to read arbitrary files on the host machine
|
|
by creating an entity pointing to a local file. Removing
|
|
the XML_PARSE_NOENT flag means that any entities are left
|
|
unchanged by the parser, or expanded to "" by the XPath
|
|
APIs.
|
|
|
|
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
(cherry picked from commit d6b27d3e4c40946efa79e91d134616b41b1666c4)
|
|
---
|
|
src/util/virxml.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/util/virxml.c b/src/util/virxml.c
|
|
index 5852374..de1e1e0 100644
|
|
--- a/src/util/virxml.c
|
|
+++ b/src/util/virxml.c
|
|
@@ -746,11 +746,11 @@ virXMLParseHelper(int domcode,
|
|
|
|
if (filename) {
|
|
xml = xmlCtxtReadFile(pctxt, filename, NULL,
|
|
- XML_PARSE_NOENT | XML_PARSE_NONET |
|
|
+ XML_PARSE_NONET |
|
|
XML_PARSE_NOWARNING);
|
|
} else {
|
|
xml = xmlCtxtReadDoc(pctxt, BAD_CAST xmlStr, url, NULL,
|
|
- XML_PARSE_NOENT | XML_PARSE_NONET |
|
|
+ XML_PARSE_NONET |
|
|
XML_PARSE_NOWARNING);
|
|
}
|
|
if (!xml)
|