Vinícius Ferrão 6c70a5e66c fix(xcatd): block XML external entities on the legacy parser path ...

xCAT::XML wraps XML::Simple. It blocks XML external entities. An external
entity can read a local file or a network resource.

XML::Simple with new_xml_parser() installs an ExternEnt handler. The
handler returns the system id, not the content.

XML::Simple 2.20 to 2.24 has no new_xml_parser(). On these versions xCAT
uses build_tree_xml_parser() instead. This function did not install the
handler. A SYSTEM entity then expanded. It leaked a local file into the
parsed data.

This change adds the same handler to build_tree_xml_parser(). Both paths
pass parser options in an array reference. XML::Parser->new ignores that
reference. The handler is therefore the real defense. This fix keeps
#6917, which retains the compatibility path for those releases.

This fix was recovered from the lenovobuild branch. See PR #6505.

2026-08-17 11:59:56 -03:00

..

perl/xCAT

fix(xcatd): block XML external entities on the legacy parser path

2026-08-17 11:59:56 -03:00

xcat

fix(dhcp): boot unknown xNBA clients with Kea

2026-08-10 17:12:17 -03:00