Skip to content

[6.38] [xml] prevent files parsing from root folder#21854

Merged
linev merged 4 commits intoroot-project:v6-38-00-patchesfrom
root-project-bot:BP_6.38_pull_21812
Apr 9, 2026
Merged

[6.38] [xml] prevent files parsing from root folder#21854
linev merged 4 commits intoroot-project:v6-38-00-patchesfrom
root-project-bot:BP_6.38_pull_21812

Conversation

@root-project-bot
Copy link
Copy Markdown

@root-project-bot root-project-bot commented Apr 9, 2026

Backport of #21812, requested by @linev.

linev added 2 commits April 9, 2026 05:37
@linev
[xml] prevent access to external files below current directory
d7e44b7 
Check using `std::filesystem::proximate` functionality

(cherry picked from commit a766b51)
@linev
[xml] precise error print output
053d808 
When file cannot be opened - do not try to parse it, just print failure
And print correctly error when string is parsing

(cherry picked from commit 72fbd33)
linev added 2 commits April 9, 2026 08:55
@linev
[roottest] add testing of string parsing with TXMLEngine
30400d0 
Such string parsing also can include access to local xml files

(cherry picked from commit e8b5782)
@linev
[roottest] add TXMLEngine test with forbidden file paths
51037a1 
Use of parent or top directory paths are not allowed
So control proper error messages in the output

(cherry picked from commit fb1c27f)
@linev linev force-pushed the BP_6.38_pull_21812 branch from 9bcb146 to 51037a1 Compare April 9, 2026 06:56
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 9, 2026

Test Results

    19 files      19 suites   2d 21h 3m 1s ⏱️
 3 719 tests  3 719 ✅ 0 💤 0 ❌
68 922 runs  68 922 ✅ 0 💤 0 ❌

Results for commit 51037a1.

@linev linev merged commit adce801 into root-project:v6-38-00-patches Apr 9, 2026
25 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@linev linev linev approved these changes

@bellenot bellenot Awaiting requested review from bellenot bellenot is a code owner

@pcanal pcanal Awaiting requested review from pcanal pcanal is a code owner

@dpiparo dpiparo Awaiting requested review from dpiparo dpiparo is a code owner

Assignees

@linev linev

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@root-project-bot @linev