bpo-42051: Reject XML entity declarations in plist files by ronaldoussoren · Pull Request #22760 · python/cpython

ronaldoussoren · 2020-10-19T09:22:35Z

plistlib uses ElementTree to parse XML files, and therefore is subject to a number of XML vulnerabilities. Those can be avoided by rejecting entity declarations in XML plist files.

Doing this is safe because Apple tools like plutil(1) also reject XML files with entity declarations.

https://bugs.python.org/issue42051

tiran

Thanks, that's a simple and great solution for the issue. LGTM

bedevere-bot · 2020-10-19T18:13:52Z

@ronaldoussoren: Please replace # with GH- in the commit message next time. Thanks!

miss-islington · 2020-10-19T18:13:52Z

Thanks @ronaldoussoren for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9.
🐍🍒⛏🤖

) (cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

bedevere-bot · 2020-10-19T18:14:04Z

GH-22771 is a backport of this pull request to the 3.9 branch.

) (cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

bedevere-bot · 2020-10-19T18:14:13Z

GH-22772 is a backport of this pull request to the 3.8 branch.

miss-islington · 2020-10-19T18:40:28Z

Thanks @ronaldoussoren for the PR 🌮🎉.. I'm working now to backport this PR to: 3.6.
🐍🍒⛏🤖

miss-islington · 2020-10-19T18:40:28Z

Thanks @ronaldoussoren for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

miss-islington · 2020-10-19T18:40:32Z

Sorry, @ronaldoussoren, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 05ee790f4d1cd8725a90b54268fc1dfe5b4d1fa2 3.6

miss-islington · 2020-10-19T18:40:34Z

Sorry @ronaldoussoren, I had trouble checking out the 3.7 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 05ee790f4d1cd8725a90b54268fc1dfe5b4d1fa2 3.7

miss-islington · 2020-10-19T21:23:41Z

Thanks @ronaldoussoren for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

miss-islington · 2020-10-19T21:23:50Z

Sorry, @ronaldoussoren, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 05ee790f4d1cd8725a90b54268fc1dfe5b4d1fa2 3.7

ned-deily · 2020-10-19T21:24:36Z

I'm looking at the conflicts.

bedevere-bot · 2020-10-20T01:57:38Z

GH-22801 is a backport of this pull request to the 3.7 branch.

(cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

…-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

) (pythonGH-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> (cherry picked from commit e512bc7) Co-authored-by: Ned Deily <nad@python.org>

…H-22801) (GH-22804) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> (cherry picked from commit e512bc7) Co-authored-by: Ned Deily <nad@python.org>

) (pythonGH-22801) (pythonGH-22804) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> (cherry picked from commit e512bc7) Co-authored-by: Ned Deily <nad@python.org> Rebased for Python 2.7 by Michał Górny <mgorny@gentoo.org>

… (GC-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> Co-authored-by: Ned Deily <nad@python.org>

bpo-42051: Reject XML entity declarations in plist files (python#22760) (GC-22801)

… (GC-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> Co-authored-by: Ned Deily <nad@python.org>

… (GC-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> Co-authored-by: Ned Deily <nad@python.org> Add InvalidFileException class. RaisesRegex is RaisesRegexp in python2. plistlib.loads is in the python3 version of plistlib, but there are too many changes to backport this simply.

bpo-42051: Reject XML entity declarations in plist files

300f007

the-knights-who-say-ni added the CLA signed label Oct 19, 2020

bedevere-bot added the awaiting core review label Oct 19, 2020

ronaldoussoren added needs backport to 3.8 labels Oct 19, 2020

ronaldoussoren self-assigned this Oct 19, 2020

ronaldoussoren requested review from 1st1 and vstinner October 19, 2020 09:23

serhiy-storchaka approved these changes Oct 19, 2020

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting core review labels Oct 19, 2020

tiran approved these changes Oct 19, 2020

View reviewed changes

ronaldoussoren merged commit 05ee790 into python:master Oct 19, 2020

bedevere-bot removed the awaiting merge label Oct 19, 2020

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 19, 2020

bpo-42051: Reject XML entity declarations in plist files (pythonGH-22760

c7a5e2d

) (cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

bedevere-bot removed the needs backport to 3.9 label Oct 19, 2020

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 19, 2020

bpo-42051: Reject XML entity declarations in plist files (pythonGH-22760

893e001

) (cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

bedevere-bot removed the needs backport to 3.8 label Oct 19, 2020

ronaldoussoren added needs backport to 3.6 labels Oct 19, 2020

ned-deily added needs backport to 3.7 and removed needs backport to 3.7 labels Oct 19, 2020

ned-deily pushed a commit to ned-deily/cpython that referenced this pull request Oct 20, 2020

bpo-42051: Reject XML entity declarations in plist files (python#22760)

1f6b2bc

bedevere-bot removed the needs backport to 3.7 label Oct 20, 2020

miss-islington added a commit that referenced this pull request Oct 20, 2020

bpo-42051: Reject XML entity declarations in plist files (GH-22760)

479553c

(cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

miss-islington added a commit that referenced this pull request Oct 20, 2020

bpo-42051: Reject XML entity declarations in plist files (GH-22760)

65894ca

(cherry picked from commit 05ee790) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

ned-deily added a commit that referenced this pull request Oct 20, 2020

bpo-42051: Reject XML entity declarations in plist files (#22760) (GH…

e512bc7

…-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>

ned-deily added the type-security A security issue label Oct 20, 2020

adorilson pushed a commit to adorilson/cpython that referenced this pull request Mar 13, 2021

bpo-42051: Reject XML entity declarations in plist files (python#22760)

41d42d0

vstinner mentioned this pull request Aug 24, 2023

[security] CVE-2022-48565: Avoid plistlib XML vulnerabilities by rejecting entity directives #86217

Closed

rickprice added a commit to ActiveState/cpython that referenced this pull request Mar 12, 2024

Merge pull request #39 from ActiveState/BE-3614-CVE-2022-48565

b4803dd

bpo-42051: Reject XML entity declarations in plist files (python#22760) (GC-22801)

rickprice pushed a commit to ActiveState/cpython that referenced this pull request Jun 26, 2024

bpo-42051: Reject XML entity declarations in plist files (python#22760)…

6c10354

… (GC-22801) Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com> Co-authored-by: Ned Deily <nad@python.org>

Uh oh!

Conversation

ronaldoussoren commented Oct 19, 2020 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tiran left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-bot commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

bedevere-bot commented Oct 19, 2020

Uh oh!

bedevere-bot commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

miss-islington commented Oct 19, 2020

Uh oh!

ned-deily commented Oct 19, 2020

Uh oh!

bedevere-bot commented Oct 20, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

ronaldoussoren commented Oct 19, 2020 •

edited by bedevere-bot

Loading