View | Details | Raw Unified | Return to bug 23290
Collapse All | Expand All

(-)a/Koha/XSLT/Security.pm (-1 / +1 lines)
Lines 144-150 sub set_parser_options { Link Here
144 
    my ($self, $parser) = @_;
 144 
    my ($self, $parser) = @_;
145 
    my $conf = $self->{_options};
 145 
    my $conf = $self->{_options};
146 

          146
          

        

          
            

              147
              
    if( $conf->{expand_entities} ) {


              147
              
    if( $conf->{expand_entities_unsafe} ) { # NOT recommended

            

        

          148
          
        _set_option($parser, 'expand_entities', 1);

          148
          
        _set_option($parser, 'expand_entities', 1);

        

        

          149
          
    } else {

          149
          
    } else {

        

        

          150
          
        # If not explicitly set, we should disable expanding for security

          150
          
        # If not explicitly set, we should disable expanding for security

        



(-)a/t/db_dependent/Koha/XSLT/Security.t
      (-3 / +2 lines)




  

    
      
            Lines 25-31
          use Test::Warn;
      
      
        Link Here
      
    
  

        

          25
          
use Koha::XSLT::Base;

          25
          
use Koha::XSLT::Base;

        

        

          26
          
use t::lib::Mocks;

          26
          
use t::lib::Mocks;

        

        

          27
          

          27
          

        

          
            

              28
              
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );


              28
              
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 1 } );

            

        

          29
          
my $engine=Koha::XSLT::Base->new;

          29
          
my $engine=Koha::XSLT::Base->new;

        

        

          30
          

          30
          

        

        

          31
          
my $secret_file = mytempfile('Big secret');

          31
          
my $secret_file = mytempfile('Big secret');

        

  

    
      
            Lines 44-50
          my $xslt_file = mytempfile($xslt);
      
      
        Link Here
      
    
  

        

          44
          
my $output= $engine->transform( "<ignored/>", $xslt_file );

          44
          
my $output= $engine->transform( "<ignored/>", $xslt_file );

        

        

          45
          
like($output, qr/Big secret/, 'external entity got through');

          45
          
like($output, qr/Big secret/, 'external entity got through');

        

        

          46
          

          46
          

        

          
            

              47
              
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );


              47
              
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );

            

        

          48
          
$engine=Koha::XSLT::Base->new;

          48
          
$engine=Koha::XSLT::Base->new;

        

        

          49
          
$output= $engine->transform( "<ignored/>", $xslt_file );

          49
          
$output= $engine->transform( "<ignored/>", $xslt_file );

        

        

          50
          
unlike($output, qr/Big secret/, 'external entity did not get through');

          50
          
unlike($output, qr/Big secret/, 'external entity did not get through');

        

            

              51
              
- 

              
              
            






  

  Return to bug 23290