Attachment 597754 Details for Bug 805938 – Backported fix

[patch] Backported fix

raptor-1.4.16-CVE-2012-0037.patch (text/plain), 13.66 KB, created by Jaroslav Škarvada on 2012-07-12 10:05:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jaroslav Škarvada

Created: 2012-07-12 10:05:03 UTC

Size: 13.66 KB

patch

obsolete

>diff --git a/src/raptor.h b/src/raptor.h
>--- a/src/raptor.h
>+++ b/src/raptor.h
>@@ -365,6 +365,7 @@ typedef struct {
>  *   for GRDDL parser.
>  * @RAPTOR_FEATURE_WWW_TIMEOUT: Set timeout for internal WWW URI requests
>  *   for GRDDL parser.
>+ * @RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES: When reading XML, load external entities.
>  * @RAPTOR_FEATURE_LAST: Internal
>  *
>  * Raptor parser, serializer or XML writer features.
>@@ -398,7 +399,8 @@ typedef enum {
>   RAPTOR_FEATURE_MICROFORMATS,
>   RAPTOR_FEATURE_HTML_LINK,
>   RAPTOR_FEATURE_WWW_TIMEOUT,
>-  RAPTOR_FEATURE_LAST=RAPTOR_FEATURE_WWW_TIMEOUT
>+  RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES,
>+  RAPTOR_FEATURE_LAST=RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES
> } raptor_feature;
> 
> 
>diff --git a/src/raptor_feature.c b/src/raptor_feature.c
>--- a/src/raptor_feature.c
>+++ b/src/raptor_feature.c
>@@ -82,7 +82,8 @@ static struct
>   { RAPTOR_FEATURE_HTML_TAG_SOUP     , 1,  "htmlTagSoup", "HTML parsing uses a lax HTML parser" },
>   { RAPTOR_FEATURE_MICROFORMATS      , 1,  "microformats", "GRDDL parsing looks for microformats" },
>   { RAPTOR_FEATURE_HTML_LINK         , 1,  "htmlLink", "GRDDL parsing looks for <link type=\"application/rdf+xml\">" },
>-  { RAPTOR_FEATURE_WWW_TIMEOUT       , 1,  "wwwTimeout", "Set internal WWW URI retrieval timeout" }
>+  { RAPTOR_FEATURE_WWW_TIMEOUT       , 1,  "wwwTimeout", "Set internal WWW URI retrieval timeout" },
>+  { RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES, 1, "loadExternalEntities", "Load external XML entities." }
> };
> 
> 
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_internal.h raptor-1.4.17/src/raptor_internal.h
>--- raptor-1.4.17.orig/src/raptor_internal.h	2008-03-25 23:16:30.000000000 -0700
>+++ raptor-1.4.17/src/raptor_internal.h	2012-02-04 15:06:05.000000000 -0800
>@@ -969,6 +969,14 @@
> 
>   /* base URI for resolving relative URIs or xml:base URIs */
>   raptor_uri* base_uri;
>+
>+  /* call SAX2 handlers if non-0 */
>+  int enabled;
>+
>+  /* FEATURE: 
>+   * non 0 if XML entities should be loaded
>+   */
>+  int feature_load_external_entities;
> };
> 
> void raptor_sax2_init(void);
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_libxml.c raptor-1.4.17/src/raptor_libxml.c
>--- raptor-1.4.17.orig/src/raptor_libxml.c	2008-02-24 23:24:28.000000000 -0800
>+++ raptor-1.4.17/src/raptor_libxml.c	2012-02-04 15:05:22.000000000 -0800
>@@ -142,18 +142,115 @@
> 
> static xmlParserInputPtr
> raptor_libxml_resolveEntity(void* user_data, 
>-                            const xmlChar *publicId, const xmlChar *systemId) {
>-  raptor_sax2* sax2=(raptor_sax2*)user_data;
>-  return libxml2_resolveEntity(sax2->xc, publicId, systemId);
>+                            const xmlChar *publicId, const xmlChar *systemId)
>+{
>+  raptor_sax2* sax2 = (raptor_sax2*)user_data;
>+  xmlParserCtxtPtr ctxt = sax2->xc;
>+  const unsigned char *uri_string = NULL;
>+  xmlParserInputPtr entity_input;
>+  int load_entity = 0;
>+
>+  if(ctxt->input)
>+    uri_string = (const unsigned char *)ctxt->input->filename;
>+
>+  if(!uri_string)
>+    uri_string = (const unsigned char *)ctxt->directory;
>+
>+  load_entity = sax2->feature_load_external_entities;
>+
>+  if(load_entity) {
>+    entity_input = xmlLoadExternalEntity((const char*)uri_string,
>+                                         (const char*)publicId,
>+                                         ctxt);
>+  } else {
>+    RAPTOR_DEBUG4("Not loading entity URI %s by policy for publicId '%s' systemId '%s'\n", uri_string, publicId, systemId);
>+  }
>+  
>+  return entity_input;
> }
> 
> 
> static xmlEntityPtr
>-raptor_libxml_getEntity(void* user_data, const xmlChar *name) {
>-  raptor_sax2* sax2=(raptor_sax2*)user_data;
>-  return libxml2_getEntity(sax2->xc, name);
>-}
>+raptor_libxml_getEntity(void* user_data, const xmlChar *name)
>+{
>+  raptor_sax2* sax2 = (raptor_sax2*)user_data;
>+  xmlParserCtxtPtr xc = sax2->xc;
>+  xmlEntityPtr ret = NULL;
>+
>+  if(!xc)
>+    return NULL;
>+
>+  if(!xc->inSubset) {
>+    /* looks for hardcoded set of entity names - lt, gt etc. */
>+    ret = xmlGetPredefinedEntity(name);
>+    if(ret) {
>+      RAPTOR_DEBUG2("Entity '%s' found in predefined set\n", name);
>+      return ret;
>+    }
>+  }
>+
>+  /* This section uses xmlGetDocEntity which looks for entities in
>+   * memory only, never from a file or URI 
>+   */
>+  if(xc->myDoc && (xc->myDoc->standalone == 1)) {
>+    RAPTOR_DEBUG2("Entity '%s' document is standalone\n", name);
>+    /* Document is standalone: no entities are required to interpret doc */
>+    if(xc->inSubset == 2) {
>+      xc->myDoc->standalone = 0;
>+      ret = xmlGetDocEntity(xc->myDoc, name);
>+      xc->myDoc->standalone = 1;
>+    } else {
>+      ret = xmlGetDocEntity(xc->myDoc, name);
>+      if(!ret) {
>+        xc->myDoc->standalone = 0;
>+        ret = xmlGetDocEntity(xc->myDoc, name);
>+        xc->myDoc->standalone = 1;
>+      }
>+    }
>+  } else {
>+    ret = xmlGetDocEntity(xc->myDoc, name);
>+  }
> 
>+  if(ret && !ret->children &&
>+    (ret->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)) {
>+    /* Entity is an external general parsed entity. It may be in a
>+     * catalog file, user file or user URI
>+     */
>+    int val = 0;
>+    xmlNodePtr children;
>+    int load_entity = 0;
>+
>+    load_entity = sax2->feature_load_external_entities;
>+
>+    if(!load_entity) {
>+      RAPTOR_DEBUG2("Not getting entity URI %s by policy\n", ret->URI);
>+      children = xmlNewText((const xmlChar*)"");
>+    } else {
>+      /* Disable SAX2 handlers so that the SAX2 events do not all get
>+       * sent to callbacks during dealing with the entity parsing.
>+       */
>+      sax2->enabled = 0;
>+      val = xmlParseCtxtExternalEntity(xc, ret->URI, ret->ExternalID, &children);
>+      sax2->enabled = 1;
>+    }
>+    
>+    if(!val) {
>+      xmlAddChildList((xmlNodePtr)ret, children);
>+    } else {
>+      xc->validate = 0;
>+      return NULL;
>+    }
>+    
>+    ret->owner = 1;
>+
>+    /* Mark this entity as having been checked - never do this again */
>+    if(!ret->checked)
>+      ret->checked = 1;
>+  }
>+
>+  return ret;
>+}
>+  
> 
> static xmlEntityPtr
> raptor_libxml_getParameterEntity(void* user_data, const xmlChar *name) {
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_parse.c raptor-1.4.17/src/raptor_parse.c
>--- raptor-1.4.17.orig/src/raptor_parse.c	2008-03-25 23:16:30.000000000 -0700
>+++ raptor-1.4.17/src/raptor_parse.c	2012-02-04 15:05:25.000000000 -0800
>@@ -1343,6 +1343,7 @@
>     case RAPTOR_FEATURE_MICROFORMATS:
>     case RAPTOR_FEATURE_HTML_LINK:
>     case RAPTOR_FEATURE_WWW_TIMEOUT:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
>       parser->features[(int)feature]=value;
>       break;
> 
>@@ -1461,6 +1462,7 @@
>     case RAPTOR_FEATURE_MICROFORMATS:
>     case RAPTOR_FEATURE_HTML_LINK:
>     case RAPTOR_FEATURE_WWW_TIMEOUT:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
>       result=(parser->features[(int)feature] != 0);
>       break;
> 
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_rdfxml.c raptor-1.4.17/src/raptor_rdfxml.c
>--- raptor-1.4.17.orig/src/raptor_rdfxml.c	2008-03-26 00:26:03.000000000 -0700
>+++ raptor-1.4.17/src/raptor_rdfxml.c	2012-02-04 15:05:29.000000000 -0800
>@@ -1124,6 +1124,9 @@
>   raptor_sax2_set_feature(rdf_xml_parser->sax2, 
>                           RAPTOR_FEATURE_NO_NET,
>                           rdf_parser->features[RAPTOR_FEATURE_NO_NET]);
>+  raptor_sax2_set_feature(rdf_xml_parser->sax2, 
>+                          RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES,
>+                          rdf_parser->features[RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES]);
>   
>   raptor_sax2_parse_start(rdf_xml_parser->sax2, uri);
> 
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_rss.c raptor-1.4.17/src/raptor_rss.c
>--- raptor-1.4.17.orig/src/raptor_rss.c	2008-01-12 11:27:15.000000000 -0800
>+++ raptor-1.4.17/src/raptor_rss.c	2012-02-04 15:05:33.000000000 -0800
>@@ -243,6 +243,9 @@
>   raptor_sax2_set_feature(rss_parser->sax2, 
>                           RAPTOR_FEATURE_NO_NET,
>                           rdf_parser->features[RAPTOR_FEATURE_NO_NET]);
>+  raptor_sax2_set_feature(rss_parser->sax2, 
>+                          RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES,
>+                          rdf_parser->features[RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES]);
>   
>   raptor_sax2_parse_start(rss_parser->sax2, uri);
> 
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_sax2.c raptor-1.4.17/src/raptor_sax2.c
>--- raptor-1.4.17.orig/src/raptor_sax2.c	2008-03-26 00:26:03.000000000 -0700
>+++ raptor-1.4.17/src/raptor_sax2.c	2012-02-04 15:05:38.000000000 -0800
>@@ -96,6 +96,8 @@
> 
>   sax2->user_data=user_data;
> 
>+  sax2->enabled = 1;
>+
>   sax2->locator=error_handlers->locator;
>   
>   sax2->error_handlers=error_handlers;
>@@ -684,6 +686,10 @@
>       sax2->feature_no_net=value;
>       break;
> 
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
>+      sax2->feature_load_external_entities=value;
>+      break;
>+
>     case RAPTOR_FEATURE_SCANNING:
>     case RAPTOR_FEATURE_ASSUME_IS_RDF:
>     case RAPTOR_FEATURE_ALLOW_NON_NS_ATTRIBUTES:
>@@ -762,6 +768,9 @@
>   unsigned char *xml_language=NULL;
>   raptor_uri *xml_base=NULL;
> 
>+  if(!sax2->enabled)
>+    return;
>+
> #ifdef RAPTOR_XML_EXPAT
> #ifdef EXPAT_UTF8_BOM_CRASH
>   sax2->tokens_count++;
>@@ -985,6 +994,9 @@
>   raptor_sax2* sax2=(raptor_sax2*)user_data;
>   raptor_xml_element* xml_element;
> 
>+  if(!sax2->enabled)
>+    return;
>+
> #ifdef RAPTOR_XML_EXPAT
> #ifdef EXPAT_UTF8_BOM_CRASH
>   sax2->tokens_count++;
>@@ -1020,6 +1032,10 @@
> raptor_sax2_characters(void* user_data, const unsigned char *s, int len)
> {
>   raptor_sax2* sax2=(raptor_sax2*)user_data;
>+
>+  if(!sax2->enabled)
>+    return;
>+
>   if(sax2->characters_handler)
>     sax2->characters_handler(sax2->user_data, sax2->current_element, s, len);
> }
>@@ -1030,6 +1046,10 @@
> raptor_sax2_cdata(void* user_data, const unsigned char *s, int len)
> {
>   raptor_sax2* sax2=(raptor_sax2*)user_data;
>+
>+  if(!sax2->enabled)
>+    return;
>+
> #ifdef RAPTOR_XML_EXPAT
> #ifdef EXPAT_UTF8_BOM_CRASH
>   sax2->tokens_count++;
>@@ -1046,6 +1066,10 @@
> raptor_sax2_comment(void* user_data, const unsigned char *s)
> {
>   raptor_sax2* sax2=(raptor_sax2*)user_data;
>+
>+  if(!sax2->enabled)
>+    return;
>+
>   if(sax2->comment_handler)
>     sax2->comment_handler(sax2->user_data, sax2->current_element, s);
> }
>@@ -1061,6 +1085,10 @@
>                                  const unsigned char* notationName)
> {
>   raptor_sax2* sax2=(raptor_sax2*)user_data;
>+
>+  if(!sax2->enabled)
>+    return;
>+
>   if(sax2->unparsed_entity_decl_handler)
>     sax2->unparsed_entity_decl_handler(sax2->user_data,
>                                        entityName, base, systemId, 
>@@ -1077,6 +1105,10 @@
>                                 const unsigned char* publicId)
> {
>   raptor_sax2* sax2=(raptor_sax2*)user_data;
>+
>+  if(!sax2->enabled)
>+    return 0;
>+
>   if(sax2->external_entity_ref_handler)
>     return sax2->external_entity_ref_handler(sax2->user_data,
>                                              context, base, systemId, publicId);
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_serialize.c raptor-1.4.17/src/raptor_serialize.c
>--- raptor-1.4.17.orig/src/raptor_serialize.c	2008-03-25 23:16:30.000000000 -0700
>+++ raptor-1.4.17/src/raptor_serialize.c	2012-02-04 15:05:41.000000000 -0800
>@@ -800,6 +800,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_WRITER_AUTO_INDENT:
>@@ -904,6 +905,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_WRITER_AUTO_INDENT:
>@@ -1029,6 +1031,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_WRITER_AUTO_INDENT:
>@@ -1122,6 +1125,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_WRITER_AUTO_INDENT:
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_turtle_writer.c raptor-1.4.17/src/raptor_turtle_writer.c
>--- raptor-1.4.17.orig/src/raptor_turtle_writer.c	2008-03-25 23:16:30.000000000 -0700
>+++ raptor-1.4.17/src/raptor_turtle_writer.c	2012-02-04 15:05:46.000000000 -0800
>@@ -724,6 +724,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_RELATIVE_URIS:
>@@ -835,6 +836,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_RELATIVE_URIS:
>diff -urN -X /Users/dajobe/dev/dontdiff -x raptor.rdf -x file1.txt -x xmlent1.rdf -x rapper -x rdfdiff raptor-1.4.17.orig/src/raptor_xml_writer.c raptor-1.4.17/src/raptor_xml_writer.c
>--- raptor-1.4.17.orig/src/raptor_xml_writer.c	2008-03-25 23:16:30.000000000 -0700
>+++ raptor-1.4.17/src/raptor_xml_writer.c	2012-02-04 15:05:49.000000000 -0800
>@@ -852,6 +852,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_RELATIVE_URIS:
>@@ -970,6 +971,7 @@
> 
>     /* Shared */
>     case RAPTOR_FEATURE_NO_NET:
>+    case RAPTOR_FEATURE_LOAD_EXTERNAL_ENTITIES:
> 
>     /* XML writer features */
>     case RAPTOR_FEATURE_RELATIVE_URIS:

Actions: View | Diff

Attachments on bug 805938: 597754 | 597811