extern/nushell
1
0
Fork 1
mirror of https://github.com/nushell/nushell.git synced 2025-05-29 06:17:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Disallow DTD by default in from xml (#15325)

Browse Source 
# Description


Follow-up to #15272, changing default to disallow DTD as discussed.
Especially applicable for the `http get` case.

# User-Facing Changes

Changes behavior introduced in #15272, so release notes need to be
updated to reflect this
This commit is contained in:
132ikl 2025-03-17 09:16:17 -04:00 committed by GitHub
parent f7f09292d6
commit 4cb195a998
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
crates/nu-command/src/formats/from/xml.rs
View File

@ -17,8 +17,8 @@ impl Command for FromXml {
.input_output_types(vec![(Type::String, Type::record())]) .input_output_types(vec![(Type::String, Type::record())])
.switch("keep-comments", "add comment nodes to result", None) .switch("keep-comments", "add comment nodes to result", None)
.switch( .switch(
"disallow-dtd", "allow-dtd",
"disallow parsing documents with DTDs (prevents exponential entity expansion attacks)", "allow parsing documents with DTDs (may result in exponential entity expansion)",
None, None,
) )
.switch( .switch(
@ -55,7 +55,7 @@ string. This way content of every tag is always a table and is easier to parse"#
let head = call.head; let head = call.head;
let keep_comments = call.has_flag(engine_state, stack, "keep-comments")?; let keep_comments = call.has_flag(engine_state, stack, "keep-comments")?;
let keep_processing_instructions = call.has_flag(engine_state, stack, "keep-pi")?; let keep_processing_instructions = call.has_flag(engine_state, stack, "keep-pi")?;
let allow_dtd = !call.has_flag(engine_state, stack, "disallow-dtd")?; let allow_dtd = call.has_flag(engine_state, stack, "allow-dtd")?;
let info = ParsingInfo { let info = ParsingInfo {
span: head, span: head,
keep_comments, keep_comments,
@ -278,7 +278,7 @@ fn process_xml_parse_error(source: String, err: roxmltree::Error, span: Span) ->
make_xml_error("The root node was opened but never closed.", span) make_xml_error("The root node was opened but never closed.", span)
} }
roxmltree::Error::DtdDetected => make_xml_error( roxmltree::Error::DtdDetected => make_xml_error(
"XML document with DTD detected.", "XML document with DTD detected.\nDTDs are disabled by default to prevent denial-of-service attacks (use --allow-dtd to parse anyway)",
span span
), ),
roxmltree::Error::NodesLimitReached => { roxmltree::Error::NodesLimitReached => {