Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 4.1.x] [Fixes #10462] GeoNode is vulnerable to an XML External Entity (XXE) injection #10467

Merged
merged 1 commit into from
Dec 22, 2022
Merged

[Backport 4.1.x] [Fixes #10462] GeoNode is vulnerable to an XML External Entity (XXE) injection #10467

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions geonode/geoserver/helpers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ def extract_name_from_sld(gs_catalog, sld, sld_file=None):
sld = sld_file.read()
if isinstance(sld, str):
sld = sld.encode('utf-8')
dom = etree.XML(sld)
dom = etree.XML(sld, parser=etree.XMLParser(resolve_entities=False))
elif sld_file and isfile(sld_file):
with open(sld_file, "rb") as sld_file:
sld = sld_file.read()
Expand Down Expand Up @@ -378,7 +378,7 @@ def set_dataset_style(saved_dataset, title, sld, base_file=None):
elif isinstance(sld, str):
sld = sld.strip('b\'\n')
sld = re.sub(r'(\\r)|(\\n)', '', sld).encode("UTF-8")
etree.XML(sld)
etree.XML(sld, parser=etree.XMLParser(resolve_entities=False))
elif base_file and isfile(base_file):
with open(base_file, "rb") as sld_file:
sld = sld_file.read()
Expand Down
18 changes: 17 additions & 1 deletion geonode/geoserver/tests/test_helpers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,10 @@
from geonode.decorators import on_ogc_backend
from geonode.tests.base import GeoNodeBaseTestSupport
from geonode.geoserver.views import _response_callback
from geonode.geoserver.helpers import get_dataset_storetype
from geonode.geoserver.helpers import (
gs_catalog,
get_dataset_storetype,
extract_name_from_sld)
from geonode.layers.populate_datasets_data import create_dataset_data

from geonode.geoserver.ows import (
Expand Down Expand Up @@ -71,6 +74,19 @@ def setUp(self):
self.passwd = 'admin'
create_dataset_data()

@on_ogc_backend(geoserver.BACKEND_PACKAGE)
def test_extract_name_from_sld(self):
content = """<?xml version="1.0" standalone="yes"?>
<!DOCTYPE foo [ <!ENTITY ent SYSTEM "/etc/passwd" > ]>
<foo xmlns="http://www.opengis.net/sld">
<NamedLayer>
<UserStyle>
<Name>&ent;</Name>
</UserStyle>
</NamedLayer>
</foo>"""
self.assertIsNone(extract_name_from_sld(gs_catalog, content))

@on_ogc_backend(geoserver.BACKEND_PACKAGE)
def test_replace_callback(self):
content = f"""<Layer>
Expand Down
4 changes: 2 additions & 2 deletions geonode/geoserver/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ def respond(*args, **kw):
if isfile(sld):
with open(sld) as sld_file:
sld = sld_file.read()
etree.XML(sld)
etree.XML(sld, parser=etree.XMLParser(resolve_entities=False))
except Exception:
logger.exception("The uploaded SLD file is not valid XML")
raise Exception(
Expand Down Expand Up @@ -799,7 +799,7 @@ def get_capabilities(request, layerid=None, user=None,
}
gc_str = tpl.render(ctx)
gc_str = gc_str.encode("utf-8", "replace")
layerelem = etree.XML(gc_str)
layerelem = etree.XML(gc_str, parser=etree.XMLParser(resolve_entities=False))
rootdoc = etree.ElementTree(layerelem)
except Exception as e:
import traceback
Expand Down