← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/nova/oneiric-updates

« back to all changes in this revision

Viewing changes to nova/utils.py

  • Committer: Package Import Robot
  • Author(s): Jamie Strandboge
  • Date: 2013-02-19 13:28:11 UTC
  • Revision ID: package-import@ubuntu.com-20130219132811-45eh6nh0crhvi761
Tags: 2011.3-0ubuntu6.12
* SECURITY UPDATE: fix denial of service
  - CVE-2013-1664.patch: Add a new utils.safe_minidom_parse_string function
    and update external API facing Nova modules to use it
  - CVE-2013-1664

Show diffs side-by-side

added added

removed removed

Lines of Context:
nova/utils.py
37
37
import time
38
38
import types
39
39
import uuid
 
40
from xml.dom import minidom
 
41
from xml.parsers import expat
 
42
from xml import sax
 
43
from xml.sax import expatreader
40
44
import pyclbr
41
45
from xml.sax import saxutils
42
46
 
514
518
        return self.done.wait()
515
519
 
516
520
 
 
521
class ProtectedExpatParser(expatreader.ExpatParser):
 
522
    """An expat parser which disables DTD's and entities by default."""
 
523
 
 
524
    def __init__(self, forbid_dtd=True, forbid_entities=True,
 
525
                 *args, **kwargs):
 
526
        # Python 2.x old style class
 
527
        expatreader.ExpatParser.__init__(self, *args, **kwargs)
 
528
        self.forbid_dtd = forbid_dtd
 
529
        self.forbid_entities = forbid_entities
 
530
 
 
531
    def start_doctype_decl(self, name, sysid, pubid, has_internal_subset):
 
532
        raise ValueError("Inline DTD forbidden")
 
533
 
 
534
    def entity_decl(self, entityName, is_parameter_entity, value, base,
 
535
                    systemId, publicId, notationName):
 
536
        raise ValueError("<!ENTITY> forbidden")
 
537
 
 
538
    def unparsed_entity_decl(self, name, base, sysid, pubid, notation_name):
 
539
        # expat 1.2
 
540
        raise ValueError("<!ENTITY> forbidden")
 
541
 
 
542
    def reset(self):
 
543
        expatreader.ExpatParser.reset(self)
 
544
        if self.forbid_dtd:
 
545
            self._parser.StartDoctypeDeclHandler = self.start_doctype_decl
 
546
        if self.forbid_entities:
 
547
            self._parser.EntityDeclHandler = self.entity_decl
 
548
            self._parser.UnparsedEntityDeclHandler = self.unparsed_entity_decl
 
549
 
 
550
 
 
551
def safe_minidom_parse_string(xml_string):
 
552
    """Parse an XML string using minidom safely.
 
553
 
 
554
    """
 
555
    try:
 
556
        return minidom.parseString(xml_string, parser=ProtectedExpatParser())
 
557
    except sax.SAXParseException as se:
 
558
        raise expat.ExpatError()
 
559
 
 
560
 
517
561
def xhtml_escape(value):
518
562
    """Escapes a string so it is valid within XML or XHTML.
519
563