[Bug 25381] New: XSLTs should not define entities
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Bug ID: 25381 Summary: XSLTs should not define entities Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity , but its presence could lead to confusion (as noted in Bug 25373). These entities should be removed from the XSLTs. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=25373 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=23290 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Academy CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 --- Comment #1 from didier <didier.gautheron@biblibre.com> --- Created attachment 104599 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104599&action=edit Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity , but its presence could lead to confusion. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 didier <didier.gautheron@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |didier.gautheron@biblibre.c | |om --- Comment #2 from didier <didier.gautheron@biblibre.com> --- Output of: for i in $(git grep -lF '<!DOCTYPE stylesheet [<!ENTITY nbsp " " >]>' ) ; do sed -i 's/ \[<!ENTITY nbsp "\ " >\]//' $i ; done In Koha source tree -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aleisha@catalyst.net.nz --- Comment #3 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Is this ready for testing? If yes can you please adjust the bug status accordingly? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I have tested the patch appleis still, switching status. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 --- Comment #5 from Aleisha Amohia <aleisha@catalyst.net.nz> --- Cool! Test plan would be to simply eyeball the patch and check that the entity definition has been removed correctly and the code still looks OK! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Eden <eden.bacani@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Eden <eden.bacani@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #104599|0 |1 is obsolete| | --- Comment #6 from Eden <eden.bacani@gmail.com> --- Created attachment 115632 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=115632&action=edit Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity , but its presence could lead to confusion. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Aleisha Amohia <aleisha@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |didier.gautheron@biblibre.c |ity.org |om -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Eden <eden.bacani@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #115632|0 |1 is obsolete| | --- Comment #7 from Eden <eden.bacani@gmail.com> --- Created attachment 115635 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=115635&action=edit Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity , but its presence could lead to confusion. Signed-off-by: Eden Bacani <eden.bacani@gmail.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #115635|0 |1 is obsolete| | --- Comment #8 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 115650 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=115650&action=edit Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity , but its presence could lead to confusion. Signed-off-by: Eden Bacani <eden.bacani@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #115650|0 |1 is obsolete| | --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 115651 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=115651&action=edit Bug 25381: XSLTs should not define entities Bug 23290 explicitly disabled entity expansion during XML parsing for security reasons. However, many XSLTs define the following entity: <!ENTITY nbsp " " > They don't use the entity , but its presence could lead to confusion. Signed-off-by: Eden Bacani <eden.bacani@gmail.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 115652 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=115652&action=edit Bug 25381: (QA follow-up) Fix occurence in the one file that escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |21.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 --- Comment #11 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 21.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Version(s)|21.05.00 |21.05.00,20.11.03 released in| | Status|Pushed to master |Pushed to stable --- Comment #12 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 20.11.x for 20.11.03 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable CC| |andrew@bywatersolutions.com Version(s)|21.05.00,20.11.03 |21.05.00,20.11.03,20.05.09 released in| | --- Comment #13 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Pushed to 20.05.x for 20.05.09 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |RESOLVED CC| |victor@tuxayo.net Resolution|--- |FIXED --- Comment #14 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Not backported to oldoldstable (19.11.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25381 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |caroline.cyr-la-rose@inlibr | |o.com -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org