Skip to content

Commit 9403b12

Browse files
dsymedsyme
authored
Merge pull request #1596 from Thorium/security-maintenance
Potential XXE vulnerability fix on XML-parsing
2 parents 9341bb3 + 529c747 commit 9403b12

10 files changed

Lines changed: 72 additions & 138 deletions

‎src/AssemblyInfo.Csv.Core.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.Csv.Core")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.Csv.Core"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.Csv.Core"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.DesignTime.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.DesignTime")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.DesignTime"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.DesignTime"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Html.Core.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.Html.Core")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.Html.Core"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.Html.Core"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Http.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.Http")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.Http"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.Http"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Json.Core.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.Json.Core")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.Json.Core"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.Json.Core"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Runtime.Utilities.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.Runtime.Utilities")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.Runtime.Utilities"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.Runtime.Utilities"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.WorldBank.Core.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.WorldBank.Core")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.WorldBank.Core"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.WorldBank.Core"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Xml.Core.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data.Xml.Core")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data.Xml.Core"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data.Xml.Core"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.fs‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3-
43
open System.Reflection
54

65
[<assembly: AssemblyTitleAttribute("FSharp.Data")>]
@@ -11,17 +10,8 @@ open System.Reflection
1110
do ()
1211

1312
module internal AssemblyVersionInformation =
14-
[<Literal>]
15-
let AssemblyTitle = "FSharp.Data"
16-
17-
[<Literal>]
18-
let AssemblyProduct = "FSharp.Data"
19-
20-
[<Literal>]
21-
let AssemblyDescription = "Library of F# type providers and data access tools"
22-
23-
[<Literal>]
24-
let AssemblyVersion = "6.6.0.0"
25-
26-
[<Literal>]
27-
let AssemblyFileVersion = "6.6.0.0"
13+
let [<Literal>] AssemblyTitle = "FSharp.Data"
14+
let [<Literal>] AssemblyProduct = "FSharp.Data"
15+
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16+
let [<Literal>] AssemblyVersion = "6.6.0.0"
17+
let [<Literal>] AssemblyFileVersion = "6.6.0.0"

‎src/FSharp.Data.Xml.Core/XmlRuntime.fs‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ namespace FSharp.Data.Runtime.BaseTypes
66

77
open System.ComponentModel
88
open System.IO
9+
open System.Xml
910
open System.Xml.Linq
1011

1112
#nowarn "10001"
@@ -56,7 +57,16 @@ type XmlElement =
5657
IsError = false)>]
5758
static member Create(reader: TextReader) =
5859
use reader = reader
59-
let element = XDocument.Load(reader, LoadOptions.PreserveWhitespace).Root
60+
// Secure XML parsing: disable DTD processing and external entities to prevent XXE attacks
61+
let xmlReaderSettings =
62+
new XmlReaderSettings(
63+
DtdProcessing = DtdProcessing.Prohibit,
64+
XmlResolver = null,
65+
MaxCharactersFromEntities = 1024L * 1024L
66+
) // 1MB limit
67+
68+
use xmlReader = XmlReader.Create(reader, xmlReaderSettings)
69+
let element = XDocument.Load(xmlReader, LoadOptions.PreserveWhitespace).Root
6070
{ XElement = element }
6171

6272
/// <exclude />
@@ -69,12 +79,26 @@ type XmlElement =
6979
use reader = reader
7080
let text = reader.ReadToEnd()
7181

82+
// Secure XML parsing: disable DTD processing and external entities to prevent XXE attacks
83+
let xmlReaderSettings =
84+
new XmlReaderSettings(
85+
DtdProcessing = DtdProcessing.Prohibit,
86+
XmlResolver = null,
87+
MaxCharactersFromEntities = 1024L * 1024L
88+
) // 1MB limit
89+
7290
try
73-
XDocument.Parse(text, LoadOptions.PreserveWhitespace).Root.Elements()
91+
use stringReader = new StringReader(text)
92+
use xmlReader = XmlReader.Create(stringReader, xmlReaderSettings)
93+
94+
XDocument.Load(xmlReader, LoadOptions.PreserveWhitespace).Root.Elements()
7495
|> Seq.map (fun value -> { XElement = value })
7596
|> Seq.toArray
7697
with _ when text.TrimStart().StartsWith "<" ->
77-
XDocument.Parse("<root>" + text + "</root>", LoadOptions.PreserveWhitespace).Root.Elements()
98+
use stringReader = new StringReader("<root>" + text + "</root>")
99+
use xmlReader = XmlReader.Create(stringReader, xmlReaderSettings)
100+
101+
XDocument.Load(xmlReader, LoadOptions.PreserveWhitespace).Root.Elements()
78102
|> Seq.map (fun value -> { XElement = value })
79103
|> Seq.toArray
80104

0 commit comments

Comments
 (0)