diff options
author | David Rothstein <drothstein@gmail.com> | 2014-08-06 13:14:03 -0400 |
---|---|---|
committer | David Rothstein <drothstein@gmail.com> | 2014-08-06 13:14:03 -0400 |
commit | 90e884ad0f7f2cf269d953f7d70966de9fd821ff (patch) | |
tree | 92c73436cab67dfbd92b2a2640a0916e933083a7 /includes/xmlrpc.inc | |
parent | f9784cf829fe2d6aad57b6de1f2e3a167e95cea6 (diff) | |
download | brdo-90e884ad0f7f2cf269d953f7d70966de9fd821ff.tar.gz brdo-90e884ad0f7f2cf269d953f7d70966de9fd821ff.tar.bz2 |
Drupal 7.31
Diffstat (limited to 'includes/xmlrpc.inc')
-rw-r--r-- | includes/xmlrpc.inc | 36 |
1 files changed, 35 insertions, 1 deletions
diff --git a/includes/xmlrpc.inc b/includes/xmlrpc.inc index b1c6f39c6..dc69dd99f 100644 --- a/includes/xmlrpc.inc +++ b/includes/xmlrpc.inc @@ -178,7 +178,41 @@ function xmlrpc_message_parse($xmlrpc_message) { xml_set_element_handler($xmlrpc_message->_parser, 'xmlrpc_message_tag_open', 'xmlrpc_message_tag_close'); xml_set_character_data_handler($xmlrpc_message->_parser, 'xmlrpc_message_cdata'); xmlrpc_message_set($xmlrpc_message); - if (!xml_parse($xmlrpc_message->_parser, $xmlrpc_message->message)) { + + // Strip XML declaration. + $header = preg_replace('/<\?xml.*?\?'.'>/s', '', substr($xmlrpc_message->message, 0, 100), 1); + $xml = trim(substr_replace($xmlrpc_message->message, $header, 0, 100)); + if ($xml == '') { + return FALSE; + } + // Strip DTD. + $header = preg_replace('/^<!DOCTYPE[^>]*+>/i', '', substr($xml, 0, 200), 1); + $xml = trim(substr_replace($xml, $header, 0, 200)); + if ($xml == '') { + return FALSE; + } + // Confirm the XML now starts with a valid root tag. A root tag can end in [> \t\r\n] + $root_tag = substr($xml, 0, strcspn(substr($xml, 0, 20), "> \t\r\n")); + // Reject a second DTD. + if (strtoupper($root_tag) == '<!DOCTYPE') { + return FALSE; + } + if (!in_array($root_tag, array('<methodCall', '<methodResponse', '<fault'))) { + return FALSE; + } + // Skip parsing if there is an unreasonably large number of tags. + try { + $dom = new DOMDocument(); + @$dom->loadXML($xml); + if ($dom->getElementsByTagName('*')->length > variable_get('xmlrpc_message_maximum_tag_count', 30000)) { + return FALSE; + } + } + catch (Exception $e) { + return FALSE; + } + + if (!xml_parse($xmlrpc_message->_parser, $xml)) { return FALSE; } xml_parser_free($xmlrpc_message->_parser); |