Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CVE-2019-15903] Deny internal entities closing the doctype (for #317) #318

Merged
merged 3 commits into from Sep 3, 2019

Conversation

@hartwork
Copy link
Member

commented Aug 27, 2019

Related to #317, work in progress.

Review wanted!

CC @yuweol @RMJ10 @DerDakon

@hartwork hartwork self-assigned this Aug 27, 2019

@hartwork hartwork force-pushed the issue-317 branch from c249720 to 44b8d2c Aug 28, 2019

@hartwork hartwork force-pushed the issue-317 branch from 44b8d2c to 1b4836f Aug 28, 2019

@hartwork hartwork changed the title [W.I.P.] xmlparse.c: Deny internal entities closing the doctype (for #317) Deny internal entities closing the doctype (for #317) Aug 28, 2019

@hartwork hartwork force-pushed the issue-317 branch from 1b4836f to 4384936 Aug 28, 2019

@hartwork

This comment has been minimized.

Copy link
Member Author

commented Aug 29, 2019

Unless someone hits the brakes, I'm aiming to merge at Tuesday 2019-09-03 evening, then requesting a CVE, waiting for the CVE request reply, then making a new release.

@hartwork hartwork added this to the 2.2.8 milestone Aug 29, 2019

@RMJ10

This comment has been minimized.

Copy link
Contributor

commented Aug 31, 2019

That looks eminently sensible to me. Is there anything else we should be disallowing from internal entities that we currently allow? I don't think so, but I haven't looked very hard.

@hartwork

This comment has been minimized.

Copy link
Member Author

commented Sep 3, 2019

Rhodri, thanks for the review!

@hartwork hartwork merged commit 6da1f19 into master Sep 3, 2019

4 checks passed

continuous-integration/appveyor/branch AppVeyor build succeeded
Details
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
continuous-integration/travis-ci/push The Travis CI build passed
Details

@hartwork hartwork changed the title Deny internal entities closing the doctype (for #317) [CVE-2019-15903] Deny internal entities closing the doctype (for #317) Sep 4, 2019

@hartwork hartwork deleted the issue-317 branch Sep 5, 2019

@hartwork hartwork referenced this pull request Sep 8, 2019
26 of 26 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.