HomePhabricator

SECURITY: Always expand xml entities when checking SVG's

Authored by csteipp.

Description

SECURITY: Always expand xml entities when checking SVG's

XmlTypeCheck's use of xml_parse for filtering SVG's sometimes left xml
entities unexpanded, which can lead to false-negatives when the
callback was used for filtering. Update XmlTypeCheck to use XMLReader
instead, tell the library to fully expand entities, and rely on the
library to error out if it encounters XML that is likely to cause a DoS
if parsed.

Bug: T88310
Change-Id: I77c77a2d6d22f549e7ef969811f7edd77a45dbba

Details

Committed
csteippApr 1 2015, 4:56 PM
Parents
rMW125ed0e5ff6b: SECURITY: Escape > in Html::expandAttributes
Branches
Unknown
Tags
Unknown
ChangeId
I77c77a2d6d22f549e7ef969811f7edd77a45dbba