After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 730290 - xmllint --xinclude --postvalid broken by CVE-2014-0191 fix
xmllint --xinclude --postvalid broken by CVE-2014-0191 fix
Status: RESOLVED FIXED
Product: libxml2
Classification: Platform
Component: general
git master
Other Linux
: Normal major
: ---
Assigned To: Daniel Veillard
libxml QA maintainers
Depends on:
Blocks:
 
 
Reported: 2014-05-17 02:46 UTC by Alexandre Rostovtsev
Modified: 2014-06-11 12:31 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
proposed patch (1.14 KB, patch)
2014-05-17 02:49 UTC, Alexandre Rostovtsev 		none Details | Review

Description Alexandre Rostovtsev 2014-05-17 02:46:02 UTC 
(As reported downstream at https://bugs.gentoo.org/show_bug.cgi?id=510508)

Commit 9cd1c3cf fixing CVE-2014-0191 changed the parser to not load external entities unless in noent or validating mode. Unfortunately, this breaks "xmllint --xinclude --postvalid" when e.g. validating docbook files, and as a result breaks the build for a number of distro packages.

My quick-and-dirty solution is to use XML_PARSE_DTDVALID | XML_PARSE_NOERROR | XML_PARSE_NOWARNING during xmllint's initial parser pass before a-posteriori validation mod: XML_PARSE_DTDVALID works around the CVE-2014-0191 fix, and XML_PARSE_NOERROR | XML_PARSE_NOWARNING ensures errors from incompletely resolved entities are suppressed during the initial parse pass.

But perhaps you may want to add some dedicated API for a-posteriori validation use cases.
Comment 1 Alexandre Rostovtsev 2014-05-17 02:49:08 UTC 
Created attachment 276694 [details] [review]
proposed patch
Comment 2 Marc Deslauriers 2014-06-06 16:46:14 UTC 
There is also another proposed patch here:

https://mail.gnome.org/archives/xml/2014-May/msg00003.html
Comment 3 Daniel Veillard 2014-06-11 12:31:26 UTC 
The final patch fixing this and a few other issues is now commited in master:

https://git.gnome.org/browse/libxml2/commit/?id=dd8367da17c2948981a51e52c8a6beb445edf825

  thanks !

Daniel