Attachment 97978 Details for Bug 23290 – Bug 23290: (QA follow-up) Rename option to expand_entities_unsafe

[patch] Bug 23290: (QA follow-up) Rename option to expand_entities_unsafe

Bug-23290-QA-follow-up-Rename-option-to-expandenti.patch (text/plain), 2.17 KB, created by Marcel de Rooy on 2020-01-27 14:09:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2020-01-27 14:09:58 UTC

Size: 2.17 KB

patch

obsolete

>From e066057d196e325b61daf8cea3afa926b6ad2d21 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Mon, 27 Jan 2020 14:06:36 +0000
>Subject: [PATCH] Bug 23290: (QA follow-up) Rename option to
> expand_entities_unsafe
>Content-Type: text/plain; charset=utf-8
>
>When you enable options marked as unsafe, we hope that you know what
>you are doing. You should, while having access to koha-conf.xml.
>
>Test plan:
>Verify that Security.t still passes.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> Koha/XSLT/Security.pm               | 2 +-
> t/db_dependent/Koha/XSLT/Security.t | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/Koha/XSLT/Security.pm b/Koha/XSLT/Security.pm
>index 55cbaddf3d..61ec7eef1a 100644
>--- a/Koha/XSLT/Security.pm
>+++ b/Koha/XSLT/Security.pm
>@@ -144,7 +144,7 @@ sub set_parser_options {
>     my ($self, $parser) = @_;
>     my $conf = $self->{_options};
> 
>-    if( $conf->{expand_entities} ) {
>+    if( $conf->{expand_entities_unsafe} ) { # NOT recommended
>         _set_option($parser, 'expand_entities', 1);
>     } else {
>         # If not explicitly set, we should disable expanding for security
>diff --git a/t/db_dependent/Koha/XSLT/Security.t b/t/db_dependent/Koha/XSLT/Security.t
>index f61c14a48e..3c4a8ac583 100644
>--- a/t/db_dependent/Koha/XSLT/Security.t
>+++ b/t/db_dependent/Koha/XSLT/Security.t
>@@ -25,7 +25,7 @@ use Test::Warn;
> use Koha::XSLT::Base;
> use t::lib::Mocks;
> 
>-t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );
>+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 1 } );
> my $engine=Koha::XSLT::Base->new;
> 
> my $secret_file = mytempfile('Big secret');
>@@ -44,7 +44,7 @@ my $xslt_file = mytempfile($xslt);
> my $output= $engine->transform( "<ignored/>", $xslt_file );
> like($output, qr/Big secret/, 'external entity got through');
> 
>-t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );
>+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
> $engine=Koha::XSLT::Base->new;
> $output= $engine->transform( "<ignored/>", $xslt_file );
> unlike($output, qr/Big secret/, 'external entity did not get through');
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 23290: 91435 | 91437 | 95450 | 95451 | 95452 | 95453 | 95454 | 95475 | 95478 | 95480 | 95481 | 95482 | 95483 | 95484 | 95485 | 95551 | 96299 | 96300 | 96301 | 96302 | 96303 | 96304 | 97606 | 97607 | 97608 | 97609 | 97610 | 97611 | 97612 | 97613 | 97614 | 97615 | 97616 | 97617 | 97618 | 97619 | 97620 | 97871 | 97978 | 97980 | 98397 | 98398 | 98399 | 98400 | 98401 | 98402 | 98403 | 98404 | 98405 | 98406 | 99587