changeset d0744bba5682 in trytond:5.0
details: https://hg.tryton.org/trytond?cmd=changeset&node=d0744bba5682
description:
Protect against XML vulnerabilities
issue11219
issue11244
(grafted from a64ca55b86e3462b5d5348c4fc8698350695b60e)
(grafted from 2ef295408a0bdc568453ca78fd564ddd48a28131)
diffstat:
CHANGELOG | 3 +++
setup.py | 1 +
trytond/__init__.py | 6 ++++++
trytond/ir/translation.py | 4 ++--
trytond/model/modelview.py | 5 +++--
trytond/protocols/xmlrpc.py | 3 +++
6 files changed, 18 insertions(+), 4 deletions(-)
diffs (111 lines):
diff -r 6306a0c00e89 -r d0744bba5682 CHANGELOG
--- a/CHANGELOG Wed Feb 16 21:57:00 2022 +0100
+++ b/CHANGELOG Tue Mar 01 19:07:56 2022 +0100
@@ -1,3 +1,6 @@
+* Do not resolve entities by default with lxml (issue11219)
+* Use defusedxml to parse XML (issue11244)
+
Version 5.0.45 - 2022-02-16
* Bug fixes (see mercurial logs for details)
diff -r 6306a0c00e89 -r d0744bba5682 setup.py
--- a/setup.py Wed Feb 16 21:57:00 2022 +0100
+++ b/setup.py Tue Mar 01 19:07:56 2022 +0100
@@ -101,6 +101,7 @@
license='GPL-3',
python_requires='>=3.4',
install_requires=[
+ 'defusedxml',
'lxml >= 2.0; python_version != "3.4"',
'lxml >=2.0, < 4.4; python_version == "3.4"',
'relatorio[fodt] >= 0.7.0',
diff -r 6306a0c00e89 -r d0744bba5682 trytond/__init__.py
--- a/trytond/__init__.py Wed Feb 16 21:57:00 2022 +0100
+++ b/trytond/__init__.py Tue Mar 01 19:07:56 2022 +0100
@@ -5,6 +5,8 @@
import warnings
from email import charset
+from lxml import etree, objectify
+
__version__ = "5.0.46"
os.environ['TZ'] = 'UTC'
@@ -16,3 +18,7 @@
# set email encoding for utf-8 to 'quoted-printable'
charset.add_charset('utf-8', charset.QP, charset.QP)
+
+# prevent XML vulnerabilities by default
+etree.set_default_parser(etree.XMLParser(resolve_entities=False))
+objectify.set_default_parser(objectify.makeparser(resolve_entities=False))
diff -r 6306a0c00e89 -r d0744bba5682 trytond/ir/translation.py
--- a/trytond/ir/translation.py Wed Feb 16 21:57:00 2022 +0100
+++ b/trytond/ir/translation.py Tue Mar 01 19:07:56 2022 +0100
@@ -1,7 +1,6 @@
# This file is part of Tryton. The COPYRIGHT file at the top level of
# this repository contains the full copyright notices and license terms.
import os
-import xml.dom.minidom
from difflib import SequenceMatcher
from collections import defaultdict
from hashlib import md5
@@ -15,6 +14,7 @@
from sql.operators import Or, And
from sql.aggregate import Max
+from defusedxml.minidom import parseString
from genshi.filters.i18n import extract as genshi_extract
from relatorio.reporting import MIMETemplateLoader
from relatorio.templates.opendocument import get_zip_file
@@ -970,7 +970,7 @@
zip_.read('content.xml'),
zip_.read('styles.xml'),
]:
- document = xml.dom.minidom.parseString(content_xml)
+ document = parseString(content_xml)
for string in extract(document.documentElement):
yield string
diff -r 6306a0c00e89 -r d0744bba5682 trytond/model/modelview.py
--- a/trytond/model/modelview.py Wed Feb 16 21:57:00 2022 +0100
+++ b/trytond/model/modelview.py Tue Mar 01 19:07:56 2022 +0100
@@ -294,7 +294,7 @@
# There is perhaps a new module in the directory
ModelView._reset_modules_list()
raise_p = True
- parser = etree.XMLParser(remove_comments=True)
+ parser = etree.XMLParser(remove_comments=True,
resolve_entities=False)
tree = etree.fromstring(result['arch'], parser=parser)
for view in views:
if view.domain:
@@ -341,7 +341,8 @@
result['view_id'] = view_id
# Update arch and compute fields from arch
- parser = etree.XMLParser(remove_blank_text=True)
+ parser = etree.XMLParser(
+ remove_blank_text=True, resolve_entities=False)
tree = etree.fromstring(result['arch'], parser)
xarch, xfields = cls._view_look_dom_arch(tree, result['type'],
result['field_childs'])
diff -r 6306a0c00e89 -r d0744bba5682 trytond/protocols/xmlrpc.py
--- a/trytond/protocols/xmlrpc.py Wed Feb 16 21:57:00 2022 +0100
+++ b/trytond/protocols/xmlrpc.py Tue Mar 01 19:07:56 2022 +0100
@@ -7,6 +7,7 @@
# convert decimal to float before marshalling:
from decimal import Decimal
+import defusedxml.xmlrpc
from werkzeug.wrappers import Response
from werkzeug.utils import cached_property
from werkzeug.exceptions import BadRequest, InternalServerError
@@ -16,6 +17,8 @@
logger = logging.getLogger(__name__)
+defusedxml.xmlrpc.monkey_patch()
+
def dump_decimal(self, value, write):
value = {'__class__': 'Decimal',
