Skip to content

[Security][Medium] XML entity-expansion (billion laughs) DoS in GP/arrangement XML parsing #45

Description

@carochacs

Found during a security audit (session that produced PR #44).

Where: lib/gp2rs.py, lib/gp2rs_gpx.py, lib/loosefolder.py, lib/song.py, lib/gp2notation.py, lib/routers/ws_highway.py:731

Issue: These parse imported Guitar Pro / arrangement XML with stdlib xml.etree.ElementTree, which Python's own docs flag as vulnerable to entity-expansion DoS (though safe from XXE/SSRF by default since 3.7.1). Two sibling files (gp8_audio_sync.py, gp_autosync.py) already guard with an optional defusedxml import, but defusedxml isn't listed in requirements*.txt, so that guard is currently inert everywhere it's used, and most XML-parsing call sites don't attempt it at all.

Impact: A crafted GP/arrangement XML file a user chooses to import can exhaust memory/CPU on the request thread — local resource exhaustion, not data exposure.

Suggested fix: Add defusedxml to requirements and either switch the parse calls to it, or apply the same <!ENTITY rejection pattern used in feedBack-plugin-musicxml-import (see that repo's mxml2notation.py) to every XML entry point listed above.

Metadata

Metadata

Assignees

Labels

securityThis is a security fix

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions