From d43bf442ab472de9ad9db6b62e9f7b02e580f466 Mon Sep 17 00:00:00 2001 From: Pierre Schmitz Date: Tue, 16 Apr 2013 05:29:15 +0200 Subject: Update to MediaWiki 1.20.4 --- includes/media/SVGMetadataExtractor.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'includes/media/SVGMetadataExtractor.php') diff --git a/includes/media/SVGMetadataExtractor.php b/includes/media/SVGMetadataExtractor.php index 851fe428..e0740385 100644 --- a/includes/media/SVGMetadataExtractor.php +++ b/includes/media/SVGMetadataExtractor.php @@ -77,7 +77,12 @@ class SVGReader { // Expand entities, since Adobe Illustrator uses them for xmlns // attributes (bug 31719). Note that libxml2 has some protection // against large recursive entity expansions so this is not as - // insecure as it might appear to be. + // insecure as it might appear to be. However, it is still extremely + // insecure. It's necessary to wrap any read() calls with + // libxml_disable_entity_loader() to avoid arbitrary local file + // inclusion, or even arbitrary code execution if the expect + // extension is installed (bug 46859). + $oldDisable = libxml_disable_entity_loader( true ); $this->reader->setParserProperty( XMLReader::SUBST_ENTITIES, true ); $this->metadata['width'] = self::DEFAULT_WIDTH; @@ -99,9 +104,11 @@ class SVGReader { // Note, if this happens, the width/height will be taken to be 0x0. // Should we consider it the default 512x512 instead? wfRestoreWarnings(); + libxml_disable_entity_loader( $oldDisable ); throw $e; } wfRestoreWarnings(); + libxml_disable_entity_loader( $oldDisable ); } /** @@ -115,7 +122,7 @@ class SVGReader { * Read the SVG * @return bool */ - public function read() { + protected function read() { $keepReading = $this->reader->read(); /* Skip until first element */ -- cgit v1.2.3-54-g00ecf