From 6f4eae73a0bf3e1c5e9597e4f9a8078cad69b1e3 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Tue, 15 Apr 2014 11:20:29 +0100 Subject: [PATCH] LSN-2014-0003: Don't expand entities when parsing XML If the XML_PARSE_NOENT flag is passed to libxml2, then any entities in the input document will be fully expanded. This allows the user to read arbitrary files on the host machine by creating an entity pointing to a local file. Removing the XML_PARSE_NOENT flag means that any entities are left unchanged by the parser, or expanded to "" by the XPath APIs. Signed-off-by: Daniel P. Berrange (cherry picked from commit d6b27d3e4c40946efa79e91d134616b41b1666c4) --- src/util/virxml.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virxml.c b/src/util/virxml.c index f8c595eb93..34e572266d 100644 --- a/src/util/virxml.c +++ b/src/util/virxml.c @@ -747,11 +747,11 @@ virXMLParseHelper(int domcode, if (filename) { xml = xmlCtxtReadFile(pctxt, filename, NULL, - XML_PARSE_NOENT | XML_PARSE_NONET | + XML_PARSE_NONET | XML_PARSE_NOWARNING); } else { xml = xmlCtxtReadDoc(pctxt, BAD_CAST xmlStr, url, NULL, - XML_PARSE_NOENT | XML_PARSE_NONET | + XML_PARSE_NONET | XML_PARSE_NOWARNING); } if (!xml) -- GitLab