HomePhabricator

SECURITY: Always expand xml entities when checking SVG's

Authored by csteipp.

Description

SECURITY: Always expand xml entities when checking SVG's

XmlTypeCheck's use of xml_parse for filtering SVG's sometimes left xml
entities unexpanded, which can lead to false-negatives when the
callback was used for filtering. Update XmlTypeCheck to use XMLReader
instead, tell the library to fully expand entities, and rely on the
library to error out if it encounters XML that is likely to cause a DoS
if parsed.

Bug: T88310
Change-Id: I77c77a2d6d22f549e7ef969811f7edd77a45dbba

Details

Committed
csteippMar 30 2015, 8:36 PM
Parents
rMW98062a7bb4a8: SECURITY: Escape > in Html::expandAttributes
Branches
Unknown
Tags
Unknown
References
refs/changes/17/201017/1
ChangeId
I77c77a2d6d22f549e7ef969811f7edd77a45dbba