dev-perl/XML-LibXML: Disable expanding external entities by default, bug 594614

Patch by ppisar@redhat.com
https://rt.cpan.org/Public/Bug/Display.html?id=118032
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838097
https://bugzilla.redhat.com/show_bug.cgi?id=1377996

Package-Manager: Portage-2.3.3, Repoman-2.3.1

diff --git a/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild b/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild
new file mode 100644 (file)
index 0000000..75c4674
--- /dev/null
+++ b/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI=6
+
+DIST_AUTHOR=SHLOMIF
+DIST_VERSION=2.0128
+DIST_EXAMPLES=("example/*")
+inherit perl-module
+
+DESCRIPTION="Perl binding for libxml2"
+
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="test minimal"
+
+RDEPEND="
+       >=dev-perl/XML-SAX-0.120.0
+       >=dev-libs/libxml2-2.6.21
+       dev-perl/XML-SAX-Base
+       >=dev-perl/XML-NamespaceSupport-1.70.0
+"
+DEPEND="${RDEPEND}
+       virtual/perl-ExtUtils-MakeMaker
+       test? (
+               !minimal? (
+                       dev-perl/Test-LeakTrace
+               )
+       )
+"
+
+PATCHES=(
+       "${FILESDIR}/${P}-disable-expanding.patch"
+)
+
+src_compile() {
+       export SKIP_SAX_INSTALL=1
+       perl-module_src_compile
+}
+
+src_test() {
+       perl_rm_files t/pod.t t/style-trailing-space.t t/cpan-changes.t
+       perl-module_src_test
+}
+
+pkg_postinst() {
+       pkg_update_parser add XML::LibXML::SAX::Parser
+       pkg_update_parser add XML::LibXML::SAX
+}
+
+pkg_postrm() {
+       pkg_update_parser remove XML::LibXML::SAX::Parser
+       pkg_update_parser remove XML::LibXML::SAX
+}
+
+pkg_update_parser() {
+       # pkg_update_parser [add|remove] $parser_module
+       local action=$1
+       local parser_module=$2
+
+       if [[ "$ROOT" = "/" ]] ; then
+               einfo "Update Parser: $1 $2"
+               perl -MXML::SAX -e "XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()" \
+                       || ewarn "Update Parser: $1 $2 failed"
+       else
+               elog "To $1 $2 run:"
+               elog "perl -MXML::SAX -e 'XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()'"
+       fi
+}

diff --git a/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch
new file mode 100644 (file)
index 0000000..8be7783
--- /dev/null
+++ b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch
@@ -0,0 +1,72 @@
+From 05749ae525317d05bd9d4232c080e530854f1d88 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Fri, 30 Sep 2016 14:31:26 +0200
+Subject: [PATCH] Do not enable expanding entities by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Expanding external entity is insecure.
+<https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing>.
+This patch makes expand_entities option disabled by default.
+
+CPAN RT#118032
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ LibXML.pm       | 2 +-
+ docs/libxml.dbk | 2 +-
+ t/43options.t   | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/LibXML.pm b/LibXML.pm
+index eb3cbd6..9ab4748 100644
+--- a/LibXML.pm
++++ b/LibXML.pm
+@@ -261,7 +261,7 @@ use constant {
+   HTML_PARSE_NOERROR  => (1<<5),       # suppress error reports
+ };
+ 
+-$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD | XML_PARSE_NOENT );
++$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD );
+ 
+ # this hash is made global so that applications can add names for new
+ # libxml2 parser flags as temporary workaround
+diff --git a/docs/libxml.dbk b/docs/libxml.dbk
+index 30f279b..2c6674b 100644
+--- a/docs/libxml.dbk
++++ b/docs/libxml.dbk
+@@ -1676,7 +1676,7 @@ local $XML::LibXML::setTagCompression = 1;</programlisting>
+             <term>expand_entities</term>
+             <listitem>
+             <para>/parser, reader/</para>
+-              <para>substitute entities; possible values are 0 and 1; default is 1</para>
++              <para>substitute entities; possible values are 0 and 1; default is 0</para>
+             <para>Note that although this flag disables entity substitution, it
+             does not prevent the parser from loading external entities;
+             when substitution of an external entity is disabled, the
+diff --git a/t/43options.t b/t/43options.t
+index 826f0ad..53dd35e 100644
+--- a/t/43options.t
++++ b/t/43options.t
+@@ -50,7 +50,7 @@ no_network
+ {
+   my $p = XML::LibXML->new();
+   for my $opt (@all) {
+-    my $ret = (($opt =~ /^(?:load_ext_dtd|expand_entities)$/) ? 1 : 0);
++    my $ret = (($opt =~ /^(?:load_ext_dtd)$/) ? 1 : 0);
+     # TEST*$all
+     ok(
+         ($p->get_option($opt)||0) == $ret
+@@ -110,7 +110,7 @@ no_network
+   ok( $p->get_option('recover') == 2, ' TODO : Add test name' );
+ 
+   # TEST
+-  ok( $p->expand_entities() == 1, ' TODO : Add test name' );
++  ok( $p->expand_entities() == 0, ' TODO : Add test name' );
+   # TEST
+   ok( $p->load_ext_dtd() == 1, ' TODO : Add test name' );
+   $p->load_ext_dtd(0);
+-- 
+2.7.4
+