| Subject: | expand_external_ents fails to work as documented |
| Date: | Tue, 27 Sep 2016 12:35:13 +0930 |
| To: | bug-XML-Twig [...] rt.cpan.org |
| From: | Doran Moppert <dmoppert [...] redhat.com> |
From the manual:
Show quoted text
> expand_external_ents
>
> When this option is used external entities (that are defined) are
> expanded when the document is output using "print" functions such as
> print , sprint , flush and xml_string . Note that in the twig the
> entity will be stored as an element with a tag '#ENT', the entity will
> not be expanded there, so you might want to process the entities
> before outputting it.
The default is indeed 0 (verified by inspecting $twig->global_state),
but it seems that external entities are expanded in *all* cases.
I'm not sure how much XML::Parser is responsible (see end of
transcript), but the manual there isn't clearly telling me how XXE
can be turned off.
Same results with XML::Twig 3.26 through 3.49.
Is there a good way to de-fang this behaviour that I have failed to
identify?
~~~
$ cat test.pl
use XML::Twig;
my $twig = XML::Twig->new( expand_external_ents => $ARGV[0] );
$twig->parsefile( "test.xml");
$twig->print;
$ cat test.xml
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe PUBLIC "bar" "boom.txt">
]>
<root>&xxe;</root>
$ echo Boom > boom.txt
$ perl test.pl 1 | grep Boom
<root>Boom
$ perl test.pl 0 | grep Boom
<root>Boom
$ perl test.pl -1 | grep Boom
<root>Boom
$ chmod 0 boom.txt
$ perl test.pl 1
cannot load SYSTEM entity 'xxe' from 'boom.txt': cannot open 'boom.txt': Permission denied at /usr/lib64/perl5/vendor_perl/XML/Parser/Expat.pm line 474.
at /usr/lib64/perl5/vendor_perl/XML/Parser.pm line 187.
eval {...} called at /usr/lib64/perl5/vendor_perl/XML/Parser.pm line 186
XML::Parser::parse(XML::Twig=HASH(0xaab468), "*XML::Parser::FILE") called at /usr/share/perl5/XML/Twig.pm line 767
eval {...} called at /usr/share/perl5/XML/Twig.pm line 767
XML::Twig::parse(XML::Twig=HASH(0xaab468), "*XML::Parser::FILE") called at /usr/lib64/perl5/vendor_perl/XML/Parser.pm line 233
eval {...} called at /usr/lib64/perl5/vendor_perl/XML/Parser.pm line 232
XML::Parser::parsefile(XML::Twig=HASH(0xaab468), "test.xml") called at /usr/share/perl5/XML/Twig.pm line 781
eval {...} called at /usr/share/perl5/XML/Twig.pm line 781
XML::Twig::parsefile(XML::Twig=HASH(0xaab468), "test.xml") called at test.pl line 4
at test.pl line 4.
at test.pl line 4.
$ perl test.pl 0
cannot expand &xxe; - cannot load 'boom.txt' at /usr/lib64/perl5/vendor_perl/XML/Parser/Expat.pm line 474.
at test.pl line 4.
at test.pl line 4.
$ perl test.pl -1
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY xxe PUBLIC "bar" "boom.txt">
]>
<root><!-- cannot expand &xxe; - cannot load 'boom.txt' --></root>
~~~
--
Doran Moppert
Red Hat Product Security
Message body not shown because it is not plain text.