Prevent XML parser from loading external entities

2023-08-04 22:24:17 +01:00 · 2023-08-04 22:24:17 +01:00 · ca0859b90f
commit ca0859b90f
parent 1062185ba0
1 changed files with 4 additions and 1 deletions
--- a/lib/pleroma/web/xml.ex
+++ b/lib/pleroma/web/xml.ex
@ -29,7 +29,10 @@ defmodule Pleroma.Web.XML do
      {doc, _rest} =
        text
        |> :binary.bin_to_list()
-        |> :xmerl_scan.string(quiet: true)
+        |> :xmerl_scan.string(
+          quiet: true,
+          fetch_fun: fn _, _ -> raise "Resolving external entities not supported" end
+        )

      {:ok, doc}
    rescue