-
Notifications
You must be signed in to change notification settings - Fork 46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fast_xml requires Expat >=2.4.5 (or backported fixes) for secure operation #46
Comments
This library is initially used in ejabberd. When ejabberd is installed from Debian or other operating systems, it will get patched expat libraries... but when installed in other ways, that can't be guaranteed. Also, fast_xml is available as a library and apparently other projects are using it: https://hex.pm/packages/fast_xml and who knows what do those projects use, or any other developers... It would be great if the vulnerability in expat could be prevented in fast_xml. That way users wouldn't need to update to fixed expat versions. Do you have any clue here, or example in other libraries? I can't help in fixing the source code... I can only help ensuring this is documented and encouraged when the next version is released. |
@badlop thanks for your reply!
I'm aware of two ways:
Both of these would rely on users using the original build system. |
Umm, I tried fast_xml with several libexpat versions that I could find in old debian versions (2.2.10, 2.4.7), and all of them give the same result, I guess all them are already fixed. query: fxml_stream:parse_element(<<"<a><d xmlns='b|c' /><d:c xmlns:d='b' /></a>">>)). gives this result. Is it patched or vulnerable? {xmlel,<<"a">>,[],
[{xmlel,<<"d">>,[{<<"xmlns">>,<<"b|c">>}],[]},
{xmlel,<<"d:c">>,[{<<"xmlns:d">>,<<"b">>}],[]}]} |
@badlop I was using |
Aha! Using libexpat1-dev from debian sid (2.4.7-1) this complains:
But, when using libexpat1-dev from debian stable (2.2.10-2) or from debian testing (2.4.4-1), it gets parsed as:
|
@badlop yes, but please note that Debian stable — codename |
@badlop PS: With regard to testing/bookworm, I believe testing does not have a |
Ah, right! I forgot to enable bullseye-security, which includes that backported fix, as you explained. Thanks! I've added a test to the suite, so packagers and admins can verify it easily. I'll make sure this is mentioned in the changelog when released. |
Cool, thank you! 👍 |
Quick update on that^^: Now resolved, testing/bookworm is at Expat |
Hi fast_xml,
it has come to my attention that the way fast_xml processes element names at…
fast_xml/c_src/fxml_stream.c
Lines 161 to 191 in 4e8d0ba
If everyone uses fast_xml with Expat >=2.4.5, then fast_xml code does not need any changes. I wanted to be sure you're aware.
For the
Dockerfile
:And for the expected output:
Best, Sebastian
The text was updated successfully, but these errors were encountered: