You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tom Lane a34e02bfaf Prevent access to external files/URLs via XML entity references. ... xml_parse() would attempt to fetch external files or URLs as needed to resolve DTD and entity references in an XML value, thus allowing unprivileged database users to attempt to fetch data with the privileges of the database server. While the external data wouldn't get returned directly to the user, portions of it could be exposed in error messages if the data didn't parse as valid XML; and in any case the mere ability to check existence of a file might be useful to an attacker. The ideal solution to this would still allow fetching of references that are listed in the host system's XML catalogs, so that documents can be validated according to installed DTDs. However, doing that with the available libxml2 APIs appears complex and error-prone, so we're not going to risk it in a security patch that necessarily hasn't gotten wide review. So this patch merely shuts off all access, causing any external fetch to silently expand to an empty string. A future patch may improve this. In HEAD and 9.2, also suppress warnings about undefined entities, which would otherwise occur as a result of not loading referenced DTDs. Previous branches don't show such warnings anyway, due to different error handling arrangements. Credit to Noah Misch for first reporting the problem, and for much work towards a solution, though this simplistic approach was not his preference. Also thanks to Daniel Veillard for consultation. Security: CVE-2012-3489		14 years ago
..
backend	Prevent access to external files/URLs via XML entity references.	14 years ago
bin	Translation updates	14 years ago
include	Fix whole-row Var evaluation to cope with resjunk columns (again).	14 years ago
interfaces	Translation updates	14 years ago
makefiles	Fix assorted issues with build and install paths containing spaces.	15 years ago
pl	Translation updates	14 years ago
port	Improve reporting of error situations in find_other_exec().	14 years ago
template	Tweak configure to attempt to add -qnoansialias to CFLAGS whenever running	17 years ago
test	Prevent access to external files/URLs via XML entity references.	14 years ago
timezone	Update time zone data files to tzdata release 2012e.	14 years ago
tools	Backpatch "Use the preferred version of xsubpp."	14 years ago
tutorial	Remove copyright mention of Andrew Yu, per author's permission.	16 years ago
.gitignore	Convert cvsignore to gitignore, and add .gitignore for build targets.	15 years ago
DEVELOPERS	Replace a couple of references to files that no longer exist in the source	17 years ago
Makefile	Add the possibility to specify an explicit validator function for foreign-data	17 years ago
Makefile.global.in	Back-patch creation of tar.bz2 tarball during "make dist".	15 years ago
Makefile.shlib	Fix assorted issues with build and install paths containing spaces.	15 years ago
bcc32.mak	…
nls-global.mk	Do not msgmerge against /dev/null; merge against the pot file itself	17 years ago
win32.mak	…