WIP for gh-71

dtd option extraction
    handling dtd: [:all, :none, :internal_only, only: [allowed entities]]
more tests needed
possibly evolve options handling

Author: Shakadak

lib/sweet_xml.ex

@@ -225,15 +225,26 @@ defmodule SweetXml do
 
   Returns an `xmlElement` record.
   """
-  def parse(doc), do: parse(doc, [])
-  def parse(doc, options) when is_binary(doc) do
-    doc |> :erlang.binary_to_list |> parse(options)
+  def parse(doc, opts \\ []) do
+    ets = :ets.new(nil, [])
+    {dtd_arg, opts} = Keyword.pop(opts, :dtd, :all)
+    opts = SweetXml.Options.handle_dtd(dtd_arg).(ets) ++ opts
+    try do
+      do_parse(doc, opts)
+    after
+      _ = :ets.delete(ets)
+    end
+  end
+
+  @doc false
+  def do_parse(doc, options) when is_binary(doc) do
+    doc |> :erlang.binary_to_list |> do_parse(options)
   end
-  def parse([c | _] = doc, options) when is_integer(c) do
+  def do_parse([c | _] = doc, options) when is_integer(c) do
     {parsed_doc, _} = :xmerl_scan.string(doc, options)
     parsed_doc
   end
-  def parse(doc_enum, options) do
+  def do_parse(doc_enum, options) do
     {parsed_doc, _} = :xmerl_scan.string('', options ++ continuation_opts(doc_enum))
     parsed_doc
   end

lib/sweet_xml/options.ex

@@ -0,0 +1,54 @@
+defmodule SweetXml.Options do
+  def handle_dtd(:all) do
+    fn _ -> [] end
+  end
+  def handle_dtd(:none) do
+    fn ets ->
+      handle_dtd(:internal_only).(ets) ++ handle_dtd(only: []).(ets)
+    end
+  end
+  def handle_dtd(:internal_only) do
+    fn _ ->
+      [fetch_fun: fn _, _ -> {:error, "no external entity allowed"} end]
+    end
+  end
+  def handle_dtd(only: entity) when is_atom(entity) do
+    handle_dtd(only: [entity])
+  end
+  def handle_dtd(only: entities) when is_list(entities) do
+    fn ets ->
+      read = fn
+        context, name, state ->
+          ets = :xmerl_scan.rules_state(state)
+          case :ets.lookup(ets, {context, name}) do
+            [] -> :undefined
+            [{_, value}] -> value
+          end
+      end
+
+        write = fn
+          :entity = context, name, value, state ->
+            _ = case name in entities do
+              true ->
+                ets = :xmerl_scan.rules_state(state)
+                _ = case :ets.lookup(ets, {context, name}) do
+                  [] -> :ets.insert(ets, {{context, name}, value})
+                  _ -> :ok
+                end
+              false -> raise("DTD not allowed: #{name}")
+            end
+            state
+
+          context, name, value, state ->
+            ets = :xmerl_scan.rules_state(state)
+            _ = case :ets.lookup(ets, {context, name}) do
+              [] -> :ets.insert(ets, {{context, name}, value})
+              _ -> :ok
+            end
+            state
+        end
+
+      [{:rules, read, write, ets}]
+    end
+  end
+end

test/files/billion_laugh.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<!DOCTYPE lolz [
+ <!ELEMENT lolz (#PCDATA)>
+ <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+ <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
+ <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
+ <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
+ <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
+ <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
+ <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
+ <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
+ <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
+]>
+<lolz>&lol9;</lolz>

test/issue_71_test.exs

@@ -0,0 +1,22 @@
+defmodule Issue71Test do
+  use ExUnit.Case
+
+  test "read /etc/passwd with dtd: :none" do
+    sneaky_xml = """
+    <?xml version=\"1.0\" encoding=\"UTF-8\"?>
+    <!DOCTYPE foo [ <!ELEMENT foo ANY >
+    <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>
+    <response><result>&xxe;</result></response>
+    """
+
+    assert {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}} =
+      catch_exit(SweetXml.parse(sneaky_xml, dtd: :none))
+  end
+
+  test "raise on billion_laugh.xml with dtd: :none" do
+    dangerous_xml = File.read!("./test/files/billion_laugh.xml")
+    assert_raise RuntimeError, fn ->
+      SweetXml.parse(dangerous_xml, dtd: :none)
+    end
+  end
+end