Skip to content

[CVE-2019-15903] Deny internal entities closing the doctype (for #317) #318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 3, 2019

Conversation

hartwork
Copy link
Member

Related to #317, work in progress.

Review wanted!

CC @yuweol @RMJ10 @DerDakon

@hartwork hartwork changed the title [W.I.P.] xmlparse.c: Deny internal entities closing the doctype (for #317) Deny internal entities closing the doctype (for #317) Aug 28, 2019
@hartwork
Copy link
Member Author

Unless someone hits the brakes, I'm aiming to merge at Tuesday 2019-09-03 evening, then requesting a CVE, waiting for the CVE request reply, then making a new release.

@hartwork hartwork added this to the 2.2.8 milestone Aug 29, 2019
@RMJ10
Copy link
Contributor

RMJ10 commented Aug 31, 2019

That looks eminently sensible to me. Is there anything else we should be disallowing from internal entities that we currently allow? I don't think so, but I haven't looked very hard.

@hartwork
Copy link
Member Author

hartwork commented Sep 3, 2019

Rhodri, thanks for the review!

@hartwork hartwork merged commit 6da1f19 into master Sep 3, 2019
@hartwork hartwork changed the title Deny internal entities closing the doctype (for #317) [CVE-2019-15903] Deny internal entities closing the doctype (for #317) Sep 4, 2019
@hartwork hartwork deleted the issue-317 branch September 5, 2019 14:50
@hartwork hartwork mentioned this pull request Sep 8, 2019
26 tasks
hartwork added a commit that referenced this pull request Nov 6, 2024
rkausch-fender pushed a commit to cclsoftware/libexpat that referenced this pull request Jan 28, 2025
Actions(deps): Bump actions/upload-artifact from 4.3.6 to 4.4.0

Merge pull request libexpat#898 from libexpat/gitignore-sync

`.gitignore`: Add missing example `element_declarations`

Merge pull request libexpat#902 from libexpat/tests-reduce-use-of-global-parser

Tests: Reduce use of global parser

Merge pull request libexpat#904 from libexpat/tests-resolve-duplicate-handler

tests: Resolve duplicate handler `accumulate_char_data`

Merge pull request libexpat#906 from libexpat/dependabot/github_actions/actions/checkout-4.2.0

Actions(deps): Bump actions/checkout from 4.1.7 to 4.2.0

Merge pull request libexpat#905 from libexpat/readme-document-use-via-cmake-fetchcontent

`README.md`: Document use of Expat via CMake >=3.18 with `FetchContent` and `SOURCE_SUBDIR`

Merge pull request libexpat#903 from Vollstrecker/patch-1

Add alias expat::expat

Merge pull request libexpat#907 from libexpat/ci-clang-19

CI: Upgrade to Clang 19

Merge pull request libexpat#910 from libexpat/fix-ci

Fix CI / `linux.yml`: Fix mishandling of package `debsuryorg-archive-keyring`

Merge pull request libexpat#912 from libexpat/dependabot/github_actions/actions/upload-artifact-4.4.3

Actions(deps): Bump actions/upload-artifact from 4.4.0 to 4.4.3

Merge pull request libexpat#911 from libexpat/dependabot/github_actions/actions/checkout-4.2.1

Actions(deps): Bump actions/checkout from 4.2.0 to 4.2.1

Merge pull request libexpat#913 from libexpat/migrate-off-of-soon-gone-macos-12

`macos.yml`: Drop `macos-12` and add `macos-15`

Merge pull request libexpat#914 from hannob/fixformatsign

Fix signedness of format strings

Merge pull request libexpat#917 from libexpat/dependabot/github_actions/actions/checkout-4.2.2

Actions(deps): Bump actions/checkout from 4.2.1 to 4.2.2

Merge pull request libexpat#915 from libexpat/stop-resumeparser-from-crashing

[CVE-2024-50602] Stop `XML_ResumeParser` from crashing

Merge pull request libexpat#918 from libexpat/issue-317-improve-tests

Improve tests for libexpat#317 (follow-up to libexpat#318)

Merge pull request libexpat#920 from libexpat/issue-919-prepare-release

Prepare release 2.6.4 (part of libexpat#919, ETA 2024-11-xx)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants