Attachment 696350 Details for Bug 910221 – keystone-essex-CVE-2013-0278.patch

[patch] keystone-essex-CVE-2013-0278.patch

keystone-essex-CVE-2013-0278.patch (text/plain), 1.90 KB, created by Kurt Seifried on 2013-02-12 03:53:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2013-02-12 03:53:11 UTC

Size: 1.90 KB

patch

obsolete

>From 76279cc7f3778488ba53d99871c2f823a517bbcc Mon Sep 17 00:00:00 2001
>From: Dolph Mathews <dolph.mathews@gmail.com>
>Date: Thu, 17 Jan 2013 20:24:30 -0600
>Subject: [PATCH] Ignore XML entities (bug 1100282)
>
>Change-Id: I915d2d956301459dd4c3d72e627853e45e05a881
>---
> keystone/common/serializer.py | 15 +++++++++++++--
> 1 file changed, 13 insertions(+), 2 deletions(-)
>
>diff --git a/keystone/common/serializer.py b/keystone/common/serializer.py
>index cd662bc..a15beea 100644
>--- a/keystone/common/serializer.py
>+++ b/keystone/common/serializer.py
>@@ -29,6 +29,16 @@ import re
> DOCTYPE = '<?xml version="1.0" encoding="UTF-8"?>'
> XMLNS = 'http://docs.openstack.org/identity/api/v2.0'
> 
>+PARSER = etree.XMLParser(
>+    resolve_entities=False,
>+    remove_comments=True,
>+    remove_pis=True)
>+
>+# NOTE(dolph): lxml.etree.Entity() is just a callable that currently returns an
>+# lxml.etree._Entity instance, which doesn't appear to be part of the
>+# public API, so we discover the type dynamically to be safe
>+ENTITY_TYPE = type(etree.Entity('x'))
>+
> 
> def from_xml(xml):
>     """Deserialize XML to a dictionary."""
>@@ -51,7 +61,7 @@ def to_xml(d, xmlns=None):
> class XmlDeserializer(object):
>     def __call__(self, xml_str):
>         """Returns a dictionary populated by decoding the given xml string."""
>-        dom = etree.fromstring(xml_str.strip())
>+        dom = etree.fromstring(xml_str.strip(), PARSER)
>         return self.walk_element(dom)
> 
>     @staticmethod
>@@ -87,7 +97,8 @@ class XmlDeserializer(object):
>         # current spec does not have attributes on an element with text
>         values = values or text or {}
> 
>-        for child in [self.walk_element(x) for x in element]:
>+        for child in [self.walk_element(x) for x in element
>+                      if not isinstance(x, ENTITY_TYPE)]:
>             values = dict(values.items() + child.items())
> 
>         return {XmlDeserializer._tag_name(element.tag): values}
>-- 
>1.8.0
>

Actions: View | Diff

Attachments on bug 910221: 696350 | 696351 | 696352