Anon/pleroma
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Prevent XML parser from loading external entities

Browse Source
This commit is contained in:
Mae 2023-08-04 22:24:17 +01:00 committed by Haelwenn (lanodan) Monnier
parent ff2f3862ab
commit fc10e07ffb
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/pleroma/web/xml.ex
View File

@ -29,7 +29,10 @@ defmodule Pleroma.Web.XML do
{doc, _rest} = {doc, _rest} =
text text
|> :binary.bin_to_list() |> :binary.bin_to_list()
|> :xmerl_scan.string(quiet: true) |> :xmerl_scan.string(
quiet: true,
fetch_fun: fn _, _ -> raise "Resolving external entities not supported" end
)
{:ok, doc} {:ok, doc}
rescue rescue