10000 prevents injection of malicious doc types · s7ntech/symfony@4e0c992 · GitHub
[go: up one dir, main page]
Skip to content

Commit 4e0c992

Browse files
fabpotfabpot
committed
prevents injection of malicious doc types
1 parent 47fe725 commit 4e0c992

File tree

12 files changed

+95
-0
lines changed

12 files changed

+95
-0
lines changed

‎src/Symfony/Component/DependencyInjection/Loader/XmlFileLoader.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,12 @@ private function parseFile($file)
223223

224224
libxml_use_internal_errors($internalErrors);
225225

226+
foreach ($dom->childNodes as $child) {
227+
if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
228+
throw new \InvalidArgumentException('Document types are not allowed.');
229+
}
230+
}
231+
226232
$this->validate($dom, $file);
227233

228234
return simplexml_import_dom($dom, 'Symfony\\Component\\DependencyInjection\\SimpleXMLElement');

‎src/Symfony/Component/Routing/Loader/XmlFileLoader.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,12 @@ protected function loadFile($file)
162162

163163
libxml_use_internal_errors($internalErrors);
164164

165+
foreach ($dom->childNodes as $child) {
166+
if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
167+
throw new \InvalidArgumentException('Document types are not allowed.');
168+
}
169+
}
170+
165171
$this->validate($dom);
166172

167173
return $dom;

‎src/Symfony/Component/Translation/Loader/XliffFileLoader.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,14 @@ private function parseFile($file)
6464
throw new \RuntimeException(implode("\n", $this->getXmlErrors($internalErrors)));
6565
}
6666

67+
foreach ($dom->childNodes as $child) {
68+
if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
69+
libxml_use_internal_errors($internalErrors);
70+
71+
throw new \RuntimeException('Document types are not allowed.');
72+
}
73+
}
74+
6775
$location = str_replace('\\', '/', __DIR__).'/schema/dic/xliff-core/xml.xsd';
6876
$parts = explode('/', $location);
6977
if (0 === stripos($location, 'phar://')) {

‎src/Symfony/Component/Validator/Mapping/Loader/XmlFileLoader.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,12 @@ protected function parseFile($file)
195195

196196
libxml_use_internal_errors($internalErrors);
197197

198+
foreach ($dom->childNodes as $child) {
199+
if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
200+
throw new MappingException('Document types are not allowed.');
201+
}
202+
}
203+
198204
return simplexml_import_dom($dom);
199205
}
200206

‎tests/Symfony/Tests/Component/DependencyInjection/Fixtures/xml/withdoctype.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE foo>
3+
<foo></foo>

‎tests/Symfony/Tests/Component/DependencyInjection/Loader/XmlFileLoaderTest.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,4 +310,16 @@ public function testNoNamingConflictsForAnonymousServices()
310310
$inner2 = $services[(string) $args2[0]];
311311
$this->assertEquals('BarClass2', $inner2->getClass(), '->load() uses the same configuration as for the anonymous ones');
312312
}
313+
314+
/**
315+
* @expectedException \InvalidArgumentException
316+
* @expectedExceptionMessage Document types are not allowed.
317+
*/
318+
public function testDocTypeIsNotAllowed()
319+
{
320+
$container = new ContainerBuilder();
321+
322+
$loader1 = new XmlFileLoader($container, new FileLocator(self::$fixturesPath.'/xml'));
323+
$loader1->load('withdoctype.xml');
324+
}
313325
}

‎tests/Symfony/Tests/Component/Routing/Fixtures/withdoctype.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE foo>
3+
<foo></foo>

‎tests/Symfony/Tests/Component/Routing/Loader/XmlFileLoaderTest.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,16 @@ public function getPathsToInvalidFiles()
7575
{
7676
return array(array('nonvalidnode.xml'), array('nonvalidroute.xml'), array('nonvalid.xml'));
7777
}
78+
79+
/**
80+
* @expectedException \InvalidArgumentException
81+
* @expectedExceptionMessage Document types are not allowed.
82+
*/
83+
public function testDocTypeIsNotAllowed()
84+
{
85+
$loader = new XmlFileLoader(new FileLocator(array(__DIR__.'/../Fixtures')));
86+
$loader->load('withdoctype.xml');
87+
}
7888
}
7989

8090
/**

‎tests/Symfony/Tests/Component/Translation/Loader/XliffFileLoaderTest.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,4 +54,14 @@ public function testLoadThrowsAnExceptionIfFileNotLocal()
5454
$resource = 'http://example.com/resources.xliff';
5555
$loader->load($resource, 'en', 'domain1');
5656
}
57+
58+
/**
59+
* @expectedException \RuntimeException
60+
* @expectedExceptionMessage Document types are not allowed.
61+
*/
62+
public function testDocTypeIsNotAllowed()
63+
{
64+
$loader = new XliffFileLoader();
65+
$loader->load(__DIR__.'/../fixtures/withdoctype.xliff', 'en', 'domain1');
66+
}
5767
}

‎tests/Symfony/Tests/Component/Translation/fixtures/withdoctype.xliff

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE foo>
3+
<xliff version="1.2" xmlns="urn:oasis:names:tc:xliff:document:1.2">
4+
<file source-language="en" datatype="plaintext" original="file.ext">
5+
<body>
6+
<trans-unit id="1">
7+
<source>foo</source>
8+
<target>bar</target>
9+
</trans-unit>
10+
</body>
11+
</file>
12+
</xliff>

0 commit comments

Comments
 (0)
0