mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
[CVE-2020-25817] Prevent loading of xml entities
This commit is contained in:
parent
8167c6f3ef
commit
7f97734a20
_config
docs/en/04_Changelogs
src/Dev
tests/php/Dev
@ -17,3 +17,6 @@ SilverStripe\Dev\DevelopmentAdmin:
|
||||
controller: Silverstripe\Dev\DevConfigController
|
||||
links:
|
||||
config: 'View the current config, useful for debugging'
|
||||
|
||||
SilverStripe\Dev\CSSContentParser:
|
||||
disable_xml_external_entities: true
|
||||
|
@ -1,5 +1,18 @@
|
||||
# 4.8.0 (Unreleased)
|
||||
|
||||
## Security patches
|
||||
|
||||
This release contains security patches. Some of those patches might require some
|
||||
updates to your project.
|
||||
|
||||
* [CVE-2020-25817 XXE Vulnerability in CSSContentParser](https://www.silverstripe.org/download/security-releases/CVE-2020-25817)
|
||||
|
||||
### CVE-2020-25817 XXE Vulnerability in CSSContentParser {#CVE-2020-25817}
|
||||
|
||||
A tool intended for dev-only use CSSContentParser parses HTML using a the SimpleXML parser. Older versions
|
||||
of libxml do not have external entity loading disabled by default. This security patches explicitly
|
||||
disables external entity loading. It can be re-enabled if required via [configuration](/_config/dev.yml)
|
||||
|
||||
## Overview
|
||||
|
||||
- [Support for silverstripe/graphql v4](#graphql-v4)
|
||||
|
@ -2,6 +2,7 @@
|
||||
|
||||
namespace SilverStripe\Dev;
|
||||
|
||||
use SilverStripe\Core\Config\Configurable;
|
||||
use SilverStripe\Core\Injector\Injectable;
|
||||
use SimpleXMLElement;
|
||||
use tidy;
|
||||
@ -25,6 +26,7 @@ use Exception;
|
||||
class CSSContentParser
|
||||
{
|
||||
use Injectable;
|
||||
use Configurable;
|
||||
|
||||
protected $simpleXML = null;
|
||||
|
||||
@ -56,6 +58,13 @@ class CSSContentParser
|
||||
$tidy = $content;
|
||||
}
|
||||
|
||||
// Prevent loading of external entities to prevent XXE attacks
|
||||
// Note: as of libxml 2.9.0 entity substitution is disabled by default so this won't be required
|
||||
if ($this->config()->get('disable_xml_external_entities')) {
|
||||
libxml_set_external_entity_loader(function () {
|
||||
return null;
|
||||
});
|
||||
}
|
||||
$this->simpleXML = @simplexml_load_string($tidy, 'SimpleXMLElement', LIBXML_NOWARNING);
|
||||
if (!$this->simpleXML) {
|
||||
throw new Exception('CSSContentParser::__construct(): Could not parse content.'
|
||||
|
@ -50,4 +50,14 @@ HTML
|
||||
$result = $parser->getBySelector('#A .other');
|
||||
$this->assertEquals("result", $result[0] . '');
|
||||
}
|
||||
|
||||
public function testXmlEntitiesDisabled()
|
||||
{
|
||||
// CSSContentParser uses simplexml to parse html
|
||||
// Ensure XML entities are not substituted in to prevent XXE attacks
|
||||
$xml = '<!DOCTYPE html [<!ENTITY myentity "World">]><html><div>Hello &myentity;</div></html>';
|
||||
$parser = new CSSContentParser($xml);
|
||||
$div = $parser->getBySelector('div')[0]->asXML();
|
||||
$this->assertEquals('<div>Hello &myentity;</div>', $div);
|
||||
}
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user