Skip to content

Commit

Permalink
refactor: remove NOENT option for security
Browse files Browse the repository at this point in the history
NOENT, which is used to substitute entities also enables processing of
both regular and external entities. Which seems risky when you don't
the XML source. NONET will have no effect if used with NOENT.

- Github Issue: ckruse#55
  • Loading branch information
shubhampathak committed Dec 6, 2019
1 parent 8d946cb commit b568969
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion lib/cfpropertylist/rbLibXMLParser.rb
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
module CFPropertyList
# XML parser
class LibXMLParser < XMLParserInterface
PARSER_OPTIONS = LibXML::XML::Parser::Options::NOBLANKS|LibXML::XML::Parser::Options::NOENT|LibXML::XML::Parser::Options::NONET
PARSER_OPTIONS = LibXML::XML::Parser::Options::NOBLANKS|LibXML::XML::Parser::Options::NONET
# read a XML file
# opts::
# * :file - The filename of the file to load
Expand Down
2 changes: 1 addition & 1 deletion lib/cfpropertylist/rbNokogiriParser.rb
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
module CFPropertyList
# XML parser
class NokogiriXMLParser < ParserInterface
PARSER_OPTIONS = Nokogiri::XML::ParseOptions::NOBLANKS|Nokogiri::XML::ParseOptions::NOENT|Nokogiri::XML::ParseOptions::NONET
PARSER_OPTIONS = Nokogiri::XML::ParseOptions::NOBLANKS|Nokogiri::XML::ParseOptions::NONET
# read a XML file
# opts::
# * :file - The filename of the file to load
Expand Down

0 comments on commit b568969

Please sign in to comment.