|
Description
David Cook
2020-05-05 23:25:39 UTC
Created attachment 104599 [details] [review] Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity  , but its presence could lead to confusion. Output of: for i in $(git grep -lF '<!DOCTYPE stylesheet [<!ENTITY nbsp " " >]>' ) ; do sed -i 's/ \[<!ENTITY nbsp "\ " >\]//' $i ; done In Koha source tree Is this ready for testing? If yes can you please adjust the bug status accordingly? I have tested the patch appleis still, switching status. Cool! Test plan would be to simply eyeball the patch and check that the entity definition has been removed correctly and the code still looks OK! Created attachment 115632 [details] [review] Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity  , but its presence could lead to confusion. Created attachment 115635 [details] [review] Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity  , but its presence could lead to confusion. Signed-off-by: Eden Bacani <eden.bacani@gmail.com> Created attachment 115650 [details] [review] Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity  , but its presence could lead to confusion. Signed-off-by: Eden Bacani <eden.bacani@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 115651 [details] [review] Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity  , but its presence could lead to confusion. Signed-off-by: Eden Bacani <eden.bacani@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 115652 [details] [review] Bug 25381: (QA follow-up) Fix occurence in the one file that escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to master for 21.05, thanks to everybody involved! Pushed to 20.11.x for 20.11.03 Pushed to 20.05.x for 20.05.09 Not backported to oldoldstable (19.11.x). Feel free to ask if it's needed. |