[PR #2807] Harden XML parsing against XXE #2804

New issue

Open

opened 2026-03-04 02:07:22 +03:00 by kerem · 0 comments

kerem commented

2026-03-04 02:07:22 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/s3fs-fuse/s3fs-fuse/pull/2807
Author: @CarstenGrohmann
Created: 2/23/2026
Status: 🔄 Open

Base: master ← Head: add_xml_entity_restrictions

📝 Commits (2)

1cc7e66 Raise minimum libxml2 version from 2.6 to 2.9
5c2cd2f Harden XML parser against XXE attacks

📊 Changes

6 files changed (+20 additions, -13 deletions)

View changed files

📝 COMPILATION.md (+2 -2)
📝 configure.ac (+8 -8)
📝 src/mpu_util.cpp (+1 -1)
📝 src/s3fs.cpp (+1 -1)
📝 src/s3fs_xml.cpp (+1 -1)
📝 src/s3fs_xml.h (+7 -0)

📄 Description

All three xmlReadMemory() calls pass options = 0. S3 responses never use DTDs or entities, so the parser should reflect that.

This PR:

raises the minimum libxml2 from 2.6 to 2.9 (released 2012, all CI targets already have >= 2.9.7)
sets XML_PARSE_NO_XXE on libxml2 >= 2.13 and XML_PARSE_NONET on 2.6–2.14 for defense in depth

Closes #2805

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/s3fs-fuse/s3fs-fuse/pull/2807 **Author:** [@CarstenGrohmann](https://github.com/CarstenGrohmann) **Created:** 2/23/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `add_xml_entity_restrictions` --- ### 📝 Commits (2) - [`1cc7e66`](https://github.com/s3fs-fuse/s3fs-fuse/commit/1cc7e66a0294ce7b0b1c2ffecd756545a0ef17e0) Raise minimum libxml2 version from 2.6 to 2.9 - [`5c2cd2f`](https://github.com/s3fs-fuse/s3fs-fuse/commit/5c2cd2faa89a6ba564e3c9a022a8c7e0a8496df2) Harden XML parser against XXE attacks ### 📊 Changes **6 files changed** (+20 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `COMPILATION.md` (+2 -2) 📝 `configure.ac` (+8 -8) 📝 `src/mpu_util.cpp` (+1 -1) 📝 `src/s3fs.cpp` (+1 -1) 📝 `src/s3fs_xml.cpp` (+1 -1) 📝 `src/s3fs_xml.h` (+7 -0) </details> ### 📄 Description All three `xmlReadMemory()` calls pass `options = 0`. S3 responses never use DTDs or entities, so the parser should reflect that. This PR: - raises the minimum libxml2 from 2.6 to 2.9 (released 2012, all CI targets already have >= 2.9.7) - sets `XML_PARSE_NO_XXE` on libxml2 >= 2.13 and `XML_PARSE_NONET` on 2.6–2.14 for defense in depth Closes #2805 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>