Git of dcc - anni/blob - patches/7(2.5.4).diff

   1 diff --git a/CHANGELOG.md b/CHANGELOG.md
   2 index 468ec101293b462c8eddaddf375d0de9e8d68fcd..9d9aadc6e8a0162d8944622f783a6301fefd6cfa 100644
   3 --- a/CHANGELOG.md
   4 +++ b/CHANGELOG.md
   5 @@ -14,6 +14,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   6
   7  ### Removed
   8
   9 +## 2.5.54
  10 +
  11 +## Security
  12 +- Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem
  13 +
  14  ## 2.5.3
  15
  16  ### Security
  17 diff --git a/changelog.d/akkoma-xml-remote-entities.security b/changelog.d/akkoma-xml-remote-entities.security
  18 new file mode 100644
  19 index 0000000000000000000000000000000000000000..5e6725e5bb5ad6a7140beb8245676a1fa0408086
  20 --- /dev/null
  21 +++ b/changelog.d/akkoma-xml-remote-entities.security
  22 @@ -0,0 +1 @@
  23 +Fix XML External Entity (XXE) loading vulnerability allowing to fetch arbitary files from the server's filesystem
  24 diff --git a/lib/pleroma/web/xml.ex b/lib/pleroma/web/xml.ex
  25 index b699446b007b07ec9e7e5f057ba6532d405a77cd..380a80ab83afe367b08a9770cac110440c6f4ccf 100644
  26 --- a/lib/pleroma/web/xml.ex
  27 +++ b/lib/pleroma/web/xml.ex
  28 @@ -29,7 +29,10 @@ def parse_document(text) do
  29        {doc, _rest} =
  30          text
  31          |> :binary.bin_to_list()
  32 -        |> :xmerl_scan.string(quiet: true)
  33 +        |> :xmerl_scan.string(
  34 +          quiet: true,
  35 +          fetch_fun: fn _, _ -> raise "Resolving external entities not supported" end
  36 +        )
  37
  38        {:ok, doc}
  39      rescue
  40 diff --git a/mix.exs b/mix.exs
  41 index d1cdb151dd25545b31f777e8c3b57e42db673357..12f721364dd75744651e5044936d195684d8cf08 100644
  42 --- a/mix.exs
  43 +++ b/mix.exs
  44 @@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
  45    def project do
  46      [
  47        app: :pleroma,
  48 -      version: version("2.5.3"),
  49 +      version: version("2.5.4"),
  50        elixir: "~> 1.11",
  51        elixirc_paths: elixirc_paths(Mix.env()),
  52        compilers: [:phoenix, :gettext] ++ Mix.compilers(),
  53 diff --git a/test/fixtures/xml_external_entities.xml b/test/fixtures/xml_external_entities.xml
  54 new file mode 100644
  55 index 0000000000000000000000000000000000000000..d5ff87134734bd072f57e41ff7662638c0cc22c8
  56 --- /dev/null
  57 +++ b/test/fixtures/xml_external_entities.xml
  58 @@ -0,0 +1,3 @@
  59 +<?xml version="1.0" encoding="UTF-8"?>
  60 +<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
  61 +<stockCheck><productId>&xxe;</productId></stockCheck>
  62 diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs
  63 index fafef54fe7040df234ee0931787a024481f6f053..be5e08776becca8ade9710f76f41a7678a2fb7c8 100644
  64 --- a/test/pleroma/web/web_finger_test.exs
  65 +++ b/test/pleroma/web/web_finger_test.exs
  66 @@ -180,5 +180,28 @@ test "respects xml content-type" do
  67
  68        {:ok, _data} = WebFinger.finger("pekorino@pawoo.net")
  69      end
  70 +
  71 +    test "refuses to process XML remote entities" do
  72 +      Tesla.Mock.mock(fn
  73 +        %{
  74 +          url: "https://pawoo.net/.well-known/webfinger?resource=acct:pekorino@pawoo.net"
  75 +        } ->
  76 +          {:ok,
  77 +           %Tesla.Env{
  78 +             status: 200,
  79 +             body: File.read!("test/fixtures/xml_external_entities.xml"),
  80 +             headers: [{"content-type", "application/xrd+xml"}]
  81 +           }}
  82 +
  83 +        %{url: "https://pawoo.net/.well-known/host-meta"} ->
  84 +          {:ok,
  85 +           %Tesla.Env{
  86 +             status: 200,
  87 +             body: File.read!("test/fixtures/tesla_mock/pawoo.net_host_meta")
  88 +           }}
  89 +      end)
  90 +
  91 +      assert :error = WebFinger.finger("pekorino@pawoo.net")
  92 +    end
  93    end
  94  end
  95 diff --git a/test/pleroma/web/xml_test.exs b/test/pleroma/web/xml_test.exs
  96 new file mode 100644
  97 index 0000000000000000000000000000000000000000..89d4709b6e7938cbc5c7d604ac2c479707d6ab5c
  98 --- /dev/null
  99 +++ b/test/pleroma/web/xml_test.exs
 100 @@ -0,0 +1,10 @@
 101 +defmodule Pleroma.Web.XMLTest do
 102 +  use Pleroma.DataCase, async: true
 103 +
 104 +  alias Pleroma.Web.XML
 105 +
 106 +  test "refuses to load external entities from XML" do
 107 +    data = File.read!("test/fixtures/xml_external_entities.xml")
 108 +    assert(:error == XML.parse_document(data))
 109 +  end
 110 +end