Skip to content

[xml] prevent files parsing from root folder#21812

Merged
linev merged 4 commits intoroot-project:masterfrom
linev:xml_warnings
Apr 9, 2026
Merged

[xml] prevent files parsing from root folder#21812
linev merged 4 commits intoroot-project:masterfrom
linev:xml_warnings

Conversation

@linev
Copy link
Copy Markdown
Member

@linev linev commented Apr 7, 2026

When parsing xml file, TXMLEngine can include other files via syntax:

<!ENTITY xxe SYSTEM "/user/home/secret.file">

So prevent inclusion of files which are not in current directory or sub-directory.
Check extra in windows that file name does not starts with drive letter like 'C:filename.ext'

Add correspondent tests to roottest/root/io/xml folder

@linev linev requested review from bellenot and dpiparo April 7, 2026 14:56
@linev linev self-assigned this Apr 7, 2026
@linev linev requested a review from pcanal as a code owner April 7, 2026 14:56
Comment thread io/xml/src/TXMLEngine.cxx Outdated
Comment thread io/xml/src/TXMLEngine.cxx Outdated
Comment thread io/xml/src/TXMLEngine.cxx Outdated
@linev linev force-pushed the xml_warnings branch 3 times, most recently from cbd1c51 to 23f5c6e Compare April 7, 2026 17:14
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 8, 2026

Test Results

    22 files      22 suites   3d 4h 59m 58s ⏱️
 3 833 tests  3 832 ✅  1 💤 0 ❌
75 653 runs  75 635 ✅ 18 💤 0 ❌

Results for commit 6d837af.

♻️ This comment has been updated with latest results.

linev added 3 commits April 8, 2026 09:53
Check using `std::filesystem::proximate` functionality
When file cannot be opened - do not try to parse it, just print failure
And print correctly error when string is parsing
Such string parsing also can include access to local xml files
Comment thread io/xml/src/TXMLEngine.cxx
Use of parent or top directory paths are not allowed
So control proper error messages in the output
@linev linev merged commit fb1c27f into root-project:master Apr 9, 2026
29 of 30 checks passed
@linev
Copy link
Copy Markdown
Member Author

linev commented Apr 9, 2026

/backport to 6.38, 6.36, 6.32, 6.30, 6.28, 6.26

@root-project-bot
Copy link
Copy Markdown

Something went wrong with the backport to 6.38: @linev please see the logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants