[GCatt-AS]

NOTE: libE57Format will not accept generative "AI" PRs at this time

Type

• New feature
• [XXX ] Bug fix
• Refactor
• Documentation/formatting

Summary

The XML Parser allows External Entites to be requested. This change adds in Xerces's Security manager and confgures some security settings to the parser.

Rationale

Without this patch, XXE is possible. This can lead to local file read and also SSRF. It's a security fix that prevents the XXE-style attack.

Additional Notes

I would have reported this under security but there's no appropriate manifest, and I know that you're a solo dev that might not have time to deal with all the issues, so i figured I'd fix it myself and just save you some effort.

I don't believe this has any downstream negative effects - I'm not sure why any of the products utilising this library might want to load external DTD files.

Checklist

• [ X] The included code and/or docs were written by a human
• [ X] If including code changes, clang-format was run on the code

[asmaloney]

Thanks Gareth!

[GCatt-AS]

No problem. I just hope I can be of some help!

I was also trying to find out a bunch of the companies that actually use this library downstreem, it's pretty cool and you mention that it's used in a bunch of commercial stuff!

[asmaloney]

it's pretty cool and you mention that it's used in a bunch of commercial stuff!

It is, but they don't participate in any way which is very unfortunate. There seem to be several which are either using a really old version of this library or the original reference library, which hasn't had any fixes in over a decade. So they certainly don't stay up to date on any of it.

[GCatt-AS]

Would it be feasible to include a security policy, for CVEs to be requested? I think this may help some of the downstream companies update their libraries. And track some bugs present in the library that become public domain afterwards, and have real risk associated.

[asmaloney]

Would it be feasible to include a security policy, for CVEs to be requested?

Yeah, I could add some details to a SECURITY.md file, but reports can be submitted here: https://github.com/asmaloney/libE57Format/security

The problem is I've been getting "medium" level security issues that are just bugs. They take a long time to go through because they're extremely verbose (clearly AI slop). (I'm not big on the whole "CVE industry" anyways...)

I think this may help some of the downstream companies update their libraries.

Honestly, I don't care what they do. 😆 They contribute nothing.

Anyways, thanks again for the PR! I appreciate it.