Skip to content

Commit df99f94

Browse files
kesarakesara
committed
fix: Terminate if SVG data includes a script tag (GHSA-cf4q-4cqr-7g7w)
1 parent 3badf55 commit df99f94

13 files changed

+56
-38
lines changed

‎tests/valid/docfile.py36.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<thead><tr>
2525
<td class="left"></td>
2626
<td class="center">Xml2rfc Vocabulary V3 Schema</td>
27-
<td class="right">March 2022</td>
27+
<td class="right">April 2022</td>
2828
</tr></thead>
2929
<tfoot><tr>
3030
<td class="left">xml2rfc(1)</td>

‎tests/valid/docfile.py37.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<thead><tr>
2525
<td class="left"></td>
2626
<td class="center">Xml2rfc Vocabulary V3 Schema</td>
27-
<td class="right">March 2022</td>
27+
<td class="right">April 2022</td>
2828
</tr></thead>
2929
<tfoot><tr>
3030
<td class="left">xml2rfc(1)</td>

‎tests/valid/docfile.py38.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<thead><tr>
2525
<td class="left"></td>
2626
<td class="center">Xml2rfc Vocabulary V3 Schema</td>
27-
<td class="right">March 2022</td>
27+
<td class="right">April 2022</td>
2828
</tr></thead>
2929
<tfoot><tr>
3030
<td class="left">xml2rfc(1)</td>

‎tests/valid/elements.prepped.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?xml version='1.0' encoding='utf-8'?>
2-
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" category="info" docName="elements-00" indexInclude="false" ipr="trust200902" obsoletes="1234,5678,9012,3456,7890" prepTime="2021-10-08T15:41:57" scripts="Cherokee,Common,Greek,Han,Hebrew,Latin" sortRefs="true" submissionType="independent" symRefs="true" tocDepth="3" tocInclude="true">
2+
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" category="info" docName="elements-00" indexInclude="false" ipr="trust200902" obsoletes="1234,5678,9012,3456,7890" prepTime="2022-04-12T02:25:45" scripts="Cherokee,Common,Greek,Han,Hebrew,Latin" sortRefs="true" submissionType="independent" symRefs="true" tocDepth="3" tocInclude="true">
33

44

55

‎tests/valid/indexes.pages.text

+8-8
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33

44

55
Network Working Group H. Person, Ed.
6-
Internet-Draft March 11, 2022
6+
Internet-Draft April 12, 2022
77
Intended status: Experimental
8-
Expires: September 12, 2022
8+
Expires: October 14, 2022
99

1010

1111
xml2rfc index tests
@@ -26,7 +26,7 @@ Status of This Memo
2626
time. It is inappropriate to use Internet-Drafts as reference
2727
material or to cite them other than as "work in progress."
2828

29-
This Internet-Draft will expire on September 12, 2022.
29+
This Internet-Draft will expire on October 14, 2022.
3030

3131
Copyright Notice
3232

@@ -53,9 +53,9 @@ Table of Contents
5353

5454

5555

56-
Person Expires September 12, 2022 [Page 1]
56+
Person Expires October 14, 2022 [Page 1]
5757

58-
Internet-Draft xml2rfc index tests March 2022
58+
Internet-Draft xml2rfc index tests April 2022
5959

6060

6161
This is another section!
@@ -109,9 +109,9 @@ Index
109109

110110

111111

112-
Person Expires September 12, 2022 [Page 2]
112+
Person Expires October 14, 2022 [Page 2]
113113

114-
Internet-Draft xml2rfc index tests March 2022
114+
Internet-Draft xml2rfc index tests April 2022
115115

116116

117117
em Section 1, Paragraph 1
@@ -165,4 +165,4 @@ Author's Address
165165

166166

167167

168-
Person Expires September 12, 2022 [Page 3]
168+
Person Expires October 14, 2022 [Page 3]

‎tests/valid/indexes.prepped.xml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?xml version='1.0' encoding='utf-8'?>
2-
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" category="exp" docName="indexes-00" indexInclude="true" ipr="trust200902" prepTime="2022-03-11T00:41:46" scripts="Common,Latin" sortRefs="true" submissionType="independent" symRefs="true" tocDepth="3" tocInclude="true">
2+
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" category="exp" docName="indexes-00" indexInclude="true" ipr="trust200902" prepTime="2022-04-12T02:27:13" scripts="Common,Latin" sortRefs="true" submissionType="independent" symRefs="true" tocDepth="3" tocInclude="true">
33
<!-- xml2rfc v2v3 conversion 3.12.3 -->
44

55

@@ -20,7 +20,7 @@
2020
</postal>
2121
</address>
2222
</author>
23-
<date day="11" month="03" year="2022"/>
23+
<date day="12" month="04" year="2022"/>
2424
<boilerplate>
2525
<section anchor="status-of-memo" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.1">
2626
<name slugifiedName="name-status-of-this-memo">Status of This Memo</name>
@@ -41,7 +41,7 @@
4141
material or to cite them other than as "work in progress."
4242
</t>
4343
<t indent="0" pn="section-boilerplate.1-4">
44-
This Internet-Draft will expire on 12 September 2022.
44+
This Internet-Draft will expire on 14 October 2022.
4545
</t>
4646
</section>
4747
<section anchor="copyright" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.2">

‎tests/valid/indexes.text

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33

44

55
Network Working Group H. Person, Ed.
6-
Internet-Draft March 11, 2022
6+
Internet-Draft April 12, 2022
77
Intended status: Experimental
8-
Expires: September 12, 2022
8+
Expires: October 14, 2022
99

1010

1111
xml2rfc index tests
@@ -26,7 +26,7 @@ Status of This Memo
2626
time. It is inappropriate to use Internet-Drafts as reference
2727
material or to cite them other than as "work in progress."
2828

29-
This Internet-Draft will expire on September 12, 2022.
29+
This Internet-Draft will expire on October 14, 2022.
3030

3131
Copyright Notice
3232

‎tests/valid/indexes.v3.py36.html

+5-5
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@
1919
<thead><tr>
2020
<td class="left">Internet-Draft</td>
2121
<td class="center">xml2rfc index tests</td>
22-
<td class="right">March 2022</td>
22+
<td class="right">April 2022</td>
2323
</tr></thead>
2424
<tfoot><tr>
2525
<td class="left">Person</td>
26-
<td class="center">Expires September 12, 2022</td>
26+
<td class="center">Expires October 14, 2022</td>
2727
<td class="right">[Page]</td>
2828
</tr></tfoot>
2929
</table>
@@ -36,12 +36,12 @@
3636
<dd class="internet-draft">indexes-00</dd>
3737
<dt class="label-published">Published:</dt>
3838
<dd class="published">
39-
<time datetime="2022-03-11" class="published">March 11, 2022</time>
39+
<time datetime="2022-04-12" class="published">April 12, 2022</time>
4040
</dd>
4141
<dt class="label-intended-status">Intended Status:</dt>
4242
<dd class="intended-status">Experimental</dd>
4343
<dt class="label-expires">Expires:</dt>
44-
<dd class="expires"><time datetime="2022-09-12">September 12, 2022</time></dd>
44+
<dd class="expires"><time datetime="2022-10-14">October 14, 2022</time></dd>
4545
<dt class="label-authors">Author:</dt>
4646
<dd class="authors">
4747
<div class="author">
@@ -71,7 +71,7 @@ <h2 id="name-status-of-this-memo">
7171
time. It is inappropriate to use Internet-Drafts as reference
7272
material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow"></a></p>
7373
<p id="section-boilerplate.1-4">
74-
This Internet-Draft will expire on September 12, 2022.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
74+
This Internet-Draft will expire on October 14, 2022.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
7575
</section>
7676
</div>
7777
<div id="copyright">

‎tests/valid/indexes.v3.py37.html

+5-5
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@
1919
<thead><tr>
2020
<td class="left">Internet-Draft</td>
2121
<td class="center">xml2rfc index tests</td>
22-
<td class="right">March 2022</td>
22+
<td class="right">April 2022</td>
2323
</tr></thead>
2424
<tfoot><tr>
2525
<td class="left">Person</td>
26-
<td class="center">Expires September 12, 2022</td>
26+
<td class="center">Expires October 14, 2022</td>
2727
<td class="right">[Page]</td>
2828
</tr></tfoot>
2929
</table>
@@ -36,12 +36,12 @@
3636
<dd class="internet-draft">indexes-00</dd>
3737
<dt class="label-published">Published:</dt>
3838
<dd class="published">
39-
<time datetime="2022-03-11" class="published">March 11, 2022</time>
39+
<time datetime="2022-04-12" class="published">April 12, 2022</time>
4040
</dd>
4141
<dt class="label-intended-status">Intended Status:</dt>
4242
<dd class="intended-status">Experimental</dd>
4343
<dt class="label-expires">Expires:</dt>
44-
<dd class="expires"><time datetime="2022-09-12">September 12, 2022</time></dd>
44+
<dd class="expires"><time datetime="2022-10-14">October 14, 2022</time></dd>
4545
<dt class="label-authors">Author:</dt>
4646
<dd class="authors">
4747
<div class="author">
@@ -71,7 +71,7 @@ <h2 id="name-status-of-this-memo">
7171
time. It is inappropriate to use Internet-Drafts as reference
7272
material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow"></a></p>
7373
<p id="section-boilerplate.1-4">
74-
This Internet-Draft will expire on September 12, 2022.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
74+
This Internet-Draft will expire on October 14, 2022.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
7575
</section>
7676
</div>
7777
<div id="copyright">

‎tests/valid/indexes.v3.py38.html

+5-5
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@
1919
<thead><tr>
2020
<td class="left">Internet-Draft</td>
2121
<td class="center">xml2rfc index tests</td>
22-
<td class="right">March 2022</td>
22+
<td class="right">April 2022</td>
2323
</tr></thead>
2424
<tfoot><tr>
2525
<td class="left">Person</td>
26-
<td class="center">Expires September 12, 2022</td>
26+
<td class="center">Expires October 14, 2022</td>
2727
<td class="right">[Page]</td>
2828
</tr></tfoot>
2929
</table>
@@ -36,12 +36,12 @@
3636
<dd class="internet-draft">indexes-00</dd>
3737
<dt class="label-published">Published:</dt>
3838
<dd class="published">
39-
<time datetime="2022-03-11" class="published">March 11, 2022</time>
39+
<time datetime="2022-04-12" class="published">April 12, 2022</time>
4040
</dd>
4141
<dt class="label-intended-status">Intended Status:</dt>
4242
<dd class="intended-status">Experimental</dd>
4343
<dt class="label-expires">Expires:</dt>
44-
<dd class="expires"><time datetime="2022-09-12">September 12, 2022</time></dd>
44+
<dd class="expires"><time datetime="2022-10-14">October 14, 2022</time></dd>
4545
<dt class="label-authors">Author:</dt>
4646
<dd class="authors">
4747
<div class="author">
@@ -71,7 +71,7 @@ <h2 id="name-status-of-this-memo">
7171
time. It is inappropriate to use Internet-Drafts as reference
7272
material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow"></a></p>
7373
<p id="section-boilerplate.1-4">
74-
This Internet-Draft will expire on September 12, 2022.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
74+
This Internet-Draft will expire on October 14, 2022.<a href="#section-boilerplate.1-4" class="pilcrow"></a></p>
7575
</section>
7676
</div>
7777
<div id="copyright">

‎tests/valid/manpage.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
xml2rfc(1) xml2rfc(1)
2-
11 March 2022
2+
12 April 2022
33

44

55
Xml2rfc Vocabulary Version 3 Schema

‎tests/valid/rfc6787.exp.xml

+3-3
Original file line numberDiff line numberDiff line change
@@ -11141,7 +11141,7 @@ identification-tag = token
1114111141
<references title="Normative References">
1114211142
<!--RTP-->
1114311143

11144-
<reference anchor="RFC3550" target="https://www.rfc-editor.org/info/rfc3550" xml:base="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.3550.xml" quote-title="true">
11144+
<reference anchor="RFC3550" target="https://www.rfc-editor.org/info/rfc3550" xml:base="https://www.rfc-editor.org/refs/bibxml/reference.RFC.3550.xml" quote-title="true">
1114511145
<front>
1114611146
<title>RTP: A Transport Protocol for Real-Time Applications</title>
1114711147
<author initials="H." surname="Schulzrinne" fullname="H. Schulzrinne"><organization/></author>
@@ -11338,7 +11338,7 @@ identification-tag = token
1133811338

1133911339
<!--Internet Message Format-->
1134011340

11341-
<reference anchor="RFC5322" target="https://www.rfc-editor.org/info/rfc5322" xml:base="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.5322.xml" quote-title="true">
11341+
<reference anchor="RFC5322" target="https://www.rfc-editor.org/info/rfc5322" xml:base="https://www.rfc-editor.org/refs/bibxml/reference.RFC.5322.xml" quote-title="true">
1134211342
<front>
1134311343
<title>Internet Message Format</title>
1134411344
<author initials="P." surname="Resnick" fullname="P. Resnick" role="editor"><organization/></author>
@@ -11420,7 +11420,7 @@ identification-tag = token
1142011420

1142111421
<!--Domain names - implementation and specification-->
1142211422

11423-
<reference anchor="RFC1035" target="https://www.rfc-editor.org/info/rfc1035" xml:base="https://xml2rfc.tools.ietf.org/public/rfc/bibxml/reference.RFC.1035.xml" quote-title="true">
11423+
<reference anchor="RFC1035" target="https://www.rfc-editor.org/info/rfc1035" xml:base="https://www.rfc-editor.org/refs/bibxml/reference.RFC.1035.xml" quote-title="true">
1142411424
<front>
1142511425
<title>Domain names - implementation and specification</title>
1142611426
<author initials="P.V." surname="Mockapetris" fullname="P.V. Mockapetris"><organization/></author>

‎xml2rfc/writers/base.py

+19-1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@
3232
bare_latin_tags, unicode_attributes, downcode, downcode_punctuation)
3333
from xml2rfc.utils import namespaces, find_duplicate_ids, slugify
3434

35+
36+
DEADLY_ERRORS = [
37+
'Element svg has extra content: script',
38+
'Did not expect element script there',
39+
]
40+
3541
default_silenced_messages = [
3642
# ".*[Pp]ostal address",
3743
]
@@ -2136,6 +2142,15 @@ def indent(e, i):
21362142
indent(e, 0)
21372143
e.tail = None
21382144

2145+
def deadly_error(self, error):
2146+
# errors that xml2rfc must not allow to continue
2147+
2148+
if error.message in DEADLY_ERRORS:
2149+
if self.options.verbose:
2150+
msg = "%s(%s): Error: Can not continue further with error: %s" % (self.xmlrfc.source, error.line, error.message)
2151+
self.log(msg)
2152+
return True
2153+
21392154
def validate(self, when='', warn=False):
21402155
# Note: Our schema doesn't permit xi:include elements, so the document
21412156
# must have had XInclude processing done before calling validate()
@@ -2164,11 +2179,14 @@ def validate(self, when='', warn=False):
21642179
"higher for better error messages." % ('.'.join(str(v) for v in lxmlver), ))
21652180
# These warnings are occasionally incorrect -- disable this
21662181
# output for now:
2182+
deadly = False
21672183
if hasattr(e, 'error_log'):
21682184
for error in e.error_log:
21692185
path = getattr(error, 'path', '')
21702186
msg = "%s(%s): %s: %s, at %s" % (self.xmlrfc.source, error.line, error.level_name.title(), error.message, path)
21712187
self.log(msg)
2188+
if not deadly:
2189+
deadly = self.deadly_error(error)
21722190
if error.message.startswith("Did not expect text"):
21732191
items = self.tree.xpath(error.path + '/text()')
21742192
for item in items:
@@ -2179,7 +2197,7 @@ def validate(self, when='', warn=False):
21792197

21802198
else:
21812199
log.warn('\nInvalid document: %s' % (e,))
2182-
if warn:
2200+
if warn and not deadly:
21832201
self.warn(self.root, 'Invalid document%s.' % (when, ))
21842202
return False
21852203
else:

0 commit comments

Comments
 (0)