From 9c7409808fd57101111f8c7ecefc59da8e01e904 Mon Sep 17 00:00:00 2001
From: FloatingGhost <hannah@coffee-and-dreams.uk>
Date: Fri, 4 Aug 2023 22:24:32 +0100
Subject: [PATCH] Add unit test for external entity loading

---
 CHANGELOG.md                            |  1 +
 test/fixtures/xml_external_entities.xml |  3 +++
 test/pleroma/web/xml_test.exs           | 10 ++++++++++
 3 files changed, 14 insertions(+)
 create mode 100644 test/fixtures/xml_external_entities.xml
 create mode 100644 test/pleroma/web/xml_test.exs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45e43beb3..deecf0d30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -39,6 +39,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ## Security
 
 - Add `no_new_privs` hardening to OpenRC and systemd service files
+- Ensured that XML parsers cannot load external entities (thanks @Mae@is.badat.dev!)
 
 ## Removed
 
diff --git a/test/fixtures/xml_external_entities.xml b/test/fixtures/xml_external_entities.xml
new file mode 100644
index 000000000..d5ff87134
--- /dev/null
+++ b/test/fixtures/xml_external_entities.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
+<stockCheck><productId>&xxe;</productId></stockCheck>
diff --git a/test/pleroma/web/xml_test.exs b/test/pleroma/web/xml_test.exs
new file mode 100644
index 000000000..89d4709b6
--- /dev/null
+++ b/test/pleroma/web/xml_test.exs
@@ -0,0 +1,10 @@
+defmodule Pleroma.Web.XMLTest do
+  use Pleroma.DataCase, async: true
+
+  alias Pleroma.Web.XML
+
+  test "refuses to load external entities from XML" do
+    data = File.read!("test/fixtures/xml_external_entities.xml")
+    assert(:error == XML.parse_document(data))
+  end
+end