allow toggling XML External Entity support for XmlParse, isXml

Description

XmlParse and isXml need an additional argument to enable using XML External Entities

https://docs.lucee.org/reference/functions/xmlparse.html

https://docs.lucee.org/reference/functions/isxml.html

adobe supports a third validator argument for xmparse (bottom of the docs, not currently mentioned in the argument summary) which we are implementing

https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-functions/functions-t-z/xmlparse.html

<cfset parseroptions = structnew()> <cfset parseroptions.ALLOWEXTERNALENTITIES = false> <cfscript> a = XmlParse("xml.xml", false, parseroptions); writeDump(a); </cfscript>

 

for other xml functions, you need to use these two functions (isXml, xmlParse) to parse the xml into an object and then work with that object, rather than directly parsing the xml as before, unless you have disabled the XXE protections at an application level (not recommended)

so, parse with xmlParse and then pass that object into the following functions

https://docs.lucee.org/reference/functions/xmltransform.html
https://docs.lucee.org/reference/functions/xmlsearch.html

etc

I also adding a env var / system property lucee.xmlfeatures.override.disable which disables overriding the default XXE settings

Activity

Pothys - MitrahSoft 
28 July 2023 at 08:16

I checked this issue with lucee fixed versions 6.0.0.523-SNAPSHOT and 5.4.2.20-SNAPSHOT. Xml External Entity is now supported for isXml & XmlParse.

Zac Spitzer 
27 July 2023 at 13:09

Zac Spitzer 
27 July 2023 at 13:01
(edited)

Zac Spitzer 
27 July 2023 at 11:40

added the ACF syntax, needs testcases too

I think `isXml()` also needs this https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-functions/functions-in-k/isxml.html

Zac Spitzer 
26 July 2023 at 18:31
(edited)

https://github.com/lucee/Lucee/pull/2196

haven’t added the ACF syntax yet…

Fixed

Details

Assignee

Reporter

Labels

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Sprint

Fix versions

Affects versions

Priority

Parent

Created 23 October 2020 at 22:06
Updated 20 May 2024 at 15:07
Resolved 31 July 2023 at 05:37