XML: removed XML_PARSE_DTDVALID during a document parsing.

When XML_PARSE_DTDVALID is enabled libxml2 parses and executes external
entities present inside an xml document.  This can lead to all the
classic XXE exploits, including SSRF and local file disclosure.

The issue was introduced in 99b9f83e4d4d (0.7.10).

Thanks to @BitK_.

diff --git a/external/njs_xml_module.c b/external/njs_xml_module.c
index 4a3bda05908e0640b46df0d6eada6427868e440c..21f2f38440a80cd63615d831730763fad19395ff 100644 (file)
--- a/external/njs_xml_module.c
+++ b/external/njs_xml_module.c
@@ -432,8 +432,7 @@ njs_xml_ext_parse(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
     }
 
     tree->doc = xmlCtxtReadMemory(tree->ctx, (char *) data.start, data.length,
-                                  NULL, NULL, XML_PARSE_DTDVALID
-                                              | XML_PARSE_NOWARNING
+                                  NULL, NULL, XML_PARSE_NOWARNING
                                               | XML_PARSE_NOERROR);
     if (njs_slow_path(tree->doc == NULL)) {
         njs_xml_error(vm, tree, "failed to parse XML");

diff --git a/test/xml/external_entity_ignored.t.js b/test/xml/external_entity_ignored.t.js
new file mode 100644 (file)
index 0000000..26ee240
--- /dev/null
+++ b/test/xml/external_entity_ignored.t.js
@@ -0,0 +1,18 @@
+/*---
+includes: [compatXml.js, compatNjs.js]
+flags: []
+paths: []
+---*/
+
+let data = `<?xml version="1.0"?>
+<!DOCTYPE foo [
+<!ENTITY c PUBLIC "bar" "extern_entity.txt">
+]>
+<root>&c;</root>
+`;
+
+if (has_njs()) {
+    const xml = require('xml');
+    let doc = xml.parse(data);
+    assert.sameValue(doc.$root.$text, "");
+}