fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-27 22:33:10 +09:00
Code Issues Projects Releases Packages Wiki Activity

fix #1227 SECISSUE

Browse source 
- XXE 취약점 문제 해결
- Drupal의 소스코드를 참고하여 `Security::detectingXEE()` 추가
  - 90e884ad0f
- blogapi 애드온 및 `Context::_setXmlRpcArgument()`에서 취약점 방어
- 제보 : 한국인터넷진흥원
This commit is contained in:
bnu 2015-02-04 13:49:21 +09:00
parent 14ffdbe5f0
commit a33a4b3081
3 changed files with 68 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
classes/context/Context.class.php
View file

@ -1240,8 +1240,15 @@ class Context
return;
}
$xml = $GLOBALS['HTTP_RAW_POST_DATA'];
if(Security::detectingXEE($xml))
{
header("HTTP/1.0 400 Bad Request");
exit;
}
$oXml = new XmlParser();
$xml_obj = $oXml->parse();
$xml_obj = $oXml->parse($xml);
$params = $xml_obj->methodcall->params;
unset($params->node_name, $params->attrs, $params->body);