Эх сурвалжийг харах

HUE-7524 [oozie] Avoid parsing XML with resolve_entities

For security purpose.
Romain Rigaux 8 жил өмнө
parent
commit
ba4000aeb9

+ 2 - 1
apps/oozie/src/oozie/importlib/coordinators.py

@@ -167,7 +167,8 @@ def import_coordinator_root(coordinator, coordinator_definition_root, metadata=N
     })
 
   # Get XSLT and Transform XML
-  xslt = etree.parse(xslt_definition_fh)
+  parser = etree.XMLParser(resolve_entities=False)
+  xslt = etree.parse(xslt_definition_fh, parser=parser)
   xslt_definition_fh.close()
   transform = etree.XSLT(xslt)
   transformed_root = transform(coordinator_definition_root)

+ 4 - 2
apps/oozie/src/oozie/importlib/workflows.py

@@ -654,7 +654,8 @@ def import_workflow_root(workflow, workflow_definition_root, metadata=None, fs=N
       })
 
     # Get XSLT
-    xslt = etree.parse(xslt_definition_fh)
+    parser = etree.XMLParser(resolve_entities=False)
+    xslt = etree.parse(xslt_definition_fh, parser=parser)
     xslt_definition_fh.close()
     transform = etree.XSLT(xslt)
 
@@ -706,7 +707,8 @@ def generate_v2_graph_nodes(workflow_definition):
     raise InvalidTagWithNamespaceException(workflow_definition_root.tag)
 
   # Get XSLT
-  xslt = etree.parse(xslt_definition_fh)
+  parser = etree.XMLParser(resolve_entities=False)
+  xslt = etree.parse(xslt_definition_fh, parser=parser)
   xslt_definition_fh.close()
   transform = etree.XSLT(xslt)