Louis-Philippe Véronneau pushed to branch master at lintian / lintian
Commits:
c3e0b568 by Nikolas Nyby at 2026-07-28T20:23:31+00:00
XML parser: Disable external entity expansion. (Closes: #1142332)
Avoid loading external entities, which can have questionable behavior when
these entities reference local devices, such as /dev/urandom. Consider
the following XML document:
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [<!ELEMENT foo ANY > <!ENTITY xxe SYSTEM
"file:///dev/urandom" >]>
<foo>&xxe;</foo>
- - - - -
781b4af3 by Nilesh Patra at 2026-07-28T20:23:31+00:00
tests(appstream-metadata-license-hang): Add test to check against hang due to
missing `expand_entities` set to `0` (test against: #1142332)
- - - - -
6 changed files:
- lib/Lintian/Check/AppstreamMetadata.pm
- lib/Lintian/Check/Debian/Copyright/Dep5.pm
- +
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/build-spec/fill-values
- +
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/build-spec/orig/improper-xml.xml
- +
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/eval/desc
- +
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/eval/hints
Changes:
=====================================
lib/Lintian/Check/AppstreamMetadata.pm
=====================================
@@ -142,6 +142,7 @@ sub check_modalias {
my $parser = XML::LibXML->new;
$parser->set_option('no_network', 1);
+ $parser->set_option('expand_entities', 0);
my $doc;
try {
=====================================
lib/Lintian/Check/Debian/Copyright/Dep5.pm
=====================================
@@ -804,6 +804,7 @@ sub check_dep5_copyright {
my $parser = XML::LibXML->new;
$parser->set_option('no_network', 1);
+ $parser->set_option('expand_entities', 0);
my $file = $self->processable->patched->resolve_path($name);
my $doc;
=====================================
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/build-spec/fill-values
=====================================
@@ -0,0 +1,3 @@
+Skeleton: upload-non-native
+Testname: appstream-metadata-license-hang
+Description: Test that lintian does not hang on parsing improper XML for
license check
=====================================
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/build-spec/orig/improper-xml.xml
=====================================
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+ <!DOCTYPE foo [<!ELEMENT foo ANY > <!ENTITY xxe SYSTEM
"file:///dev/urandom" >]>
+<foo>&xxe;</foo>
=====================================
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/eval/desc
=====================================
@@ -0,0 +1,3 @@
+Testname: appstream-metadata-license-hang
+Test-Against: inconsistent-appstream-metadata-license
+Check: debian/copyright/dep5
=====================================
t/recipes/checks/debian/copyright/dep5/appstream-metadata-license-hang/eval/hints
=====================================
@@ -0,0 +1 @@
+
View it on GitLab:
https://salsa.debian.org/lintian/lintian/-/compare/afe06b653d6976b268eb6073f29460ccbc32db15...781b4af384fd7361f1f2011fd4a0fbab44a6a542
--
View it on GitLab:
https://salsa.debian.org/lintian/lintian/-/compare/afe06b653d6976b268eb6073f29460ccbc32db15...781b4af384fd7361f1f2011fd4a0fbab44a6a542
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
