Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:python-xmltodict User: [email protected] Usertags: pu
* CVE-2025-9375: XML Injection (Closes: #1113825)
diffstat for python-xmltodict-0.13.0 python-xmltodict-0.13.0 changelog | 14 patches/0001-Prevent-XML-injection-reject-in-element-attr-names-i.patch | 105 ++++++ patches/0002-Enhance-unparse-XML-name-validation-with-stricter-ru.patch | 170 ++++++++++ patches/0003-Harden-XML-name-validation-reject-quotes-and-add-tes.patch | 50 ++ patches/series | 3 5 files changed, 342 insertions(+) diff -Nru python-xmltodict-0.13.0/debian/changelog python-xmltodict-0.13.0/debian/changelog --- python-xmltodict-0.13.0/debian/changelog 2022-08-30 00:16:25.000000000 +0300 +++ python-xmltodict-0.13.0/debian/changelog 2026-07-03 17:27:34.000000000 +0300 @@ -1,3 +1,17 @@ +python-xmltodict (0.13.0-1.1~deb13u1) trixie; urgency=medium + + * Non-maintainer upload. + * Rebuild for trixie. + + -- Adrian Bunk <[email protected]> Fri, 03 Jul 2026 17:27:34 +0300 + +python-xmltodict (0.13.0-1.1) unstable; urgency=medium + + * Non-maintainer upload. + * CVE-2025-9375: XML Injection (Closes: #1113825) + + -- Adrian Bunk <[email protected]> Sun, 28 Jun 2026 20:26:05 +0300 + python-xmltodict (0.13.0-1) unstable; urgency=medium * New upstream version 0.13.0 diff -Nru python-xmltodict-0.13.0/debian/patches/0001-Prevent-XML-injection-reject-in-element-attr-names-i.patch python-xmltodict-0.13.0/debian/patches/0001-Prevent-XML-injection-reject-in-element-attr-names-i.patch --- python-xmltodict-0.13.0/debian/patches/0001-Prevent-XML-injection-reject-in-element-attr-names-i.patch 1970-01-01 02:00:00.000000000 +0200 +++ python-xmltodict-0.13.0/debian/patches/0001-Prevent-XML-injection-reject-in-element-attr-names-i.patch 2026-06-28 20:17:51.000000000 +0300 @@ -0,0 +1,105 @@ +From 6592b0e2350ffc0d280f379f2188712ac0d2f4c7 Mon Sep 17 00:00:00 2001 +From: Martin Blech <[email protected]> +Date: Thu, 4 Sep 2025 17:25:39 -0700 +Subject: Prevent XML injection: reject '<'/'>' in element/attr names (incl. + @xmlns) + +* Add tests for tag names, attribute names, and @xmlns prefixes; confirm attr values are escaped. +--- + tests/test_dicttoxml.py | 32 ++++++++++++++++++++++++++++++++ + xmltodict.py | 20 +++++++++++++++++++- + 2 files changed, 51 insertions(+), 1 deletion(-) + +diff --git a/tests/test_dicttoxml.py b/tests/test_dicttoxml.py +index 7fc2171..c0549e8 100644 +--- a/tests/test_dicttoxml.py ++++ b/tests/test_dicttoxml.py +@@ -213,3 +213,35 @@ xmlns:b="http://b.com/";><x a:attr="val">1</x><a:y>2</a:y><b:z>3</b:z></root>''' + expected_xml = '<?xml version="1.0" encoding="utf-8"?>\n<x>false</x>' + xml = unparse(dict(x=False)) + self.assertEqual(xml, expected_xml) ++ ++ def test_rejects_tag_name_with_angle_brackets(self): ++ # Minimal guard: disallow '<' or '>' to prevent breaking tag context ++ with self.assertRaises(ValueError): ++ unparse({"m><tag>content</tag": "unsafe"}, full_document=False) ++ ++ def test_rejects_attribute_name_with_angle_brackets(self): ++ # Now we expect bad attribute names to be rejected ++ with self.assertRaises(ValueError): ++ unparse( ++ {"a": {"@m><tag>content</tag": "unsafe", "#text": "x"}}, ++ full_document=False, ++ ) ++ ++ def test_rejects_malicious_xmlns_prefix(self): ++ # xmlns prefixes go under @xmlns mapping; reject angle brackets in prefix ++ with self.assertRaises(ValueError): ++ unparse( ++ { ++ "a": { ++ "@xmlns": {"m><bad": "http://example.com/"}, ++ "#text": "x", ++ } ++ }, ++ full_document=False, ++ ) ++ ++ def test_attribute_values_with_angle_brackets_are_escaped(self): ++ # Attribute values should be escaped by XMLGenerator ++ xml = unparse({"a": {"@attr": "1<middle>2", "#text": "x"}}, full_document=False) ++ # The generated XML should contain escaped '<' and '>' within the attribute value ++ self.assertIn('attr="1<middle>2"', xml) +diff --git a/xmltodict.py b/xmltodict.py +index ca760aa..3de1c37 100755 +--- a/xmltodict.py ++++ b/xmltodict.py +@@ -379,6 +379,14 @@ def parse(xml_input, encoding=None, expat=expat, process_namespaces=False, + return handler.item + + ++def _has_angle_brackets(value): ++ """Return True if value (a str) contains '<' or '>'. ++ ++ Non-string values return False. Uses fast substring checks implemented in C. ++ """ ++ return isinstance(value, str) and ("<" in value or ">" in value) ++ ++ + def _process_namespace(name, namespaces, ns_sep=':', attr_prefix='@'): + if not namespaces: + return name +@@ -412,6 +420,9 @@ def _emit(key, value, content_handler, + if result is None: + return + key, value = result ++ # Minimal validation to avoid breaking out of tag context ++ if _has_angle_brackets(key): ++ raise ValueError('Invalid element name: "<" or ">" not allowed') + if (not hasattr(value, '__iter__') + or isinstance(value, _basestring) + or isinstance(value, dict)): +@@ -445,12 +456,19 @@ def _emit(key, value, content_handler, + attr_prefix) + if ik == '@xmlns' and isinstance(iv, dict): + for k, v in iv.items(): ++ if _has_angle_brackets(k): ++ raise ValueError( ++ 'Invalid attribute name: "<" or ">" not allowed' ++ ) + attr = 'xmlns{}'.format(':{}'.format(k) if k else '') + attrs[attr] = _unicode(v) + continue + if not isinstance(iv, _unicode): + iv = _unicode(iv) +- attrs[ik[len(attr_prefix):]] = iv ++ attr_name = ik[len(attr_prefix) :] ++ if _has_angle_brackets(attr_name): ++ raise ValueError('Invalid attribute name: "<" or ">" not allowed') ++ attrs[attr_name] = iv + continue + children.append((ik, iv)) + if pretty: +-- +2.47.3 + diff -Nru python-xmltodict-0.13.0/debian/patches/0002-Enhance-unparse-XML-name-validation-with-stricter-ru.patch python-xmltodict-0.13.0/debian/patches/0002-Enhance-unparse-XML-name-validation-with-stricter-ru.patch --- python-xmltodict-0.13.0/debian/patches/0002-Enhance-unparse-XML-name-validation-with-stricter-ru.patch 1970-01-01 02:00:00.000000000 +0200 +++ python-xmltodict-0.13.0/debian/patches/0002-Enhance-unparse-XML-name-validation-with-stricter-ru.patch 2026-06-28 20:17:51.000000000 +0300 @@ -0,0 +1,170 @@ +From 9f88d92c5cef9c3723fd502ac4e0c78a8f52d2f5 Mon Sep 17 00:00:00 2001 +From: Martin Blech <[email protected]> +Date: Mon, 8 Sep 2025 11:18:33 -0700 +Subject: Enhance unparse() XML name validation with stricter rules and tests + +Extend existing validation (previously only for "<" and ">") to also +reject element, attribute, and xmlns prefix names that are non-string, +start with "?" or "!", or contain "/", spaces, tabs, or newlines. +Update _emit and namespace handling to use _validate_name. Add tests +covering these new invalid name cases. +--- + tests/test_dicttoxml.py | 60 +++++++++++++++++++++++++++++++++++++++++ + xmltodict.py | 48 ++++++++++++++++++++++++++------- + 2 files changed, 99 insertions(+), 9 deletions(-) + +diff --git a/tests/test_dicttoxml.py b/tests/test_dicttoxml.py +index c0549e8..2e74949 100644 +--- a/tests/test_dicttoxml.py ++++ b/tests/test_dicttoxml.py +@@ -245,3 +245,63 @@ xmlns:b="http://b.com/";><x a:attr="val">1</x><a:y>2</a:y><b:z>3</b:z></root>''' + xml = unparse({"a": {"@attr": "1<middle>2", "#text": "x"}}, full_document=False) + # The generated XML should contain escaped '<' and '>' within the attribute value + self.assertIn('attr="1<middle>2"', xml) ++ ++ def test_rejects_tag_name_starting_with_question(self): ++ with self.assertRaises(ValueError): ++ unparse({"?pi": "data"}, full_document=False) ++ ++ def test_rejects_tag_name_starting_with_bang(self): ++ with self.assertRaises(ValueError): ++ unparse({"!decl": "data"}, full_document=False) ++ ++ def test_rejects_attribute_name_starting_with_question(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@?weird": "x"}}, full_document=False) ++ ++ def test_rejects_attribute_name_starting_with_bang(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@!weird": "x"}}, full_document=False) ++ ++ def test_rejects_xmlns_prefix_starting_with_question_or_bang(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"?p": "http://e/"}}}, full_document=False) ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"!p": "http://e/"}}}, full_document=False) ++ ++ def test_rejects_non_string_names(self): ++ class Weird: ++ def __str__(self): ++ return "bad>name" ++ ++ # Non-string element key ++ with self.assertRaises(ValueError): ++ unparse({Weird(): "x"}, full_document=False) ++ # Non-string attribute key ++ with self.assertRaises(ValueError): ++ unparse({"a": {Weird(): "x"}}, full_document=False) ++ ++ def test_rejects_tag_name_with_slash(self): ++ with self.assertRaises(ValueError): ++ unparse({"bad/name": "x"}, full_document=False) ++ ++ def test_rejects_tag_name_with_whitespace(self): ++ for name in ["bad name", "bad\tname", "bad\nname"]: ++ with self.assertRaises(ValueError): ++ unparse({name: "x"}, full_document=False) ++ ++ def test_rejects_attribute_name_with_slash(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@bad/name": "x"}}, full_document=False) ++ ++ def test_rejects_attribute_name_with_whitespace(self): ++ for name in ["@bad name", "@bad\tname", "@bad\nname"]: ++ with self.assertRaises(ValueError): ++ unparse({"a": {name: "x"}}, full_document=False) ++ ++ def test_rejects_xmlns_prefix_with_slash_or_whitespace(self): ++ # Slash ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"bad/prefix": "http://e/"}}}, full_document=False) ++ # Whitespace ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"bad prefix": "http://e/"}}}, full_document=False) +diff --git a/xmltodict.py b/xmltodict.py +index 3de1c37..3531169 100755 +--- a/xmltodict.py ++++ b/xmltodict.py +@@ -387,7 +387,42 @@ def _has_angle_brackets(value): + return isinstance(value, str) and ("<" in value or ">" in value) + + ++def _has_invalid_name_chars(value): ++ """Return True if value (a str) contains any disallowed name characters. ++ ++ Disallowed: '<', '>', '/', or any whitespace character. ++ Non-string values return False. ++ """ ++ if not isinstance(value, str): ++ return False ++ if "<" in value or ">" in value or "/" in value: ++ return True ++ # Check for any whitespace (spaces, tabs, newlines, etc.) ++ return any(ch.isspace() for ch in value) ++ ++ ++def _validate_name(value, kind): ++ """Validate an element/attribute name for XML safety. ++ ++ Raises ValueError with a specific reason when invalid. ++ ++ kind: 'element' or 'attribute' (used in error messages) ++ """ ++ if not isinstance(value, str): ++ raise ValueError(f"{kind} name must be a string") ++ if value.startswith("?") or value.startswith("!"): ++ raise ValueError(f'Invalid {kind} name: cannot start with "?" or "!"') ++ if "<" in value or ">" in value: ++ raise ValueError(f'Invalid {kind} name: "<" or ">" not allowed') ++ if "/" in value: ++ raise ValueError(f'Invalid {kind} name: "/" not allowed') ++ if any(ch.isspace() for ch in value): ++ raise ValueError(f"Invalid {kind} name: whitespace not allowed") ++ ++ + def _process_namespace(name, namespaces, ns_sep=':', attr_prefix='@'): ++ if not isinstance(name, str): ++ return name + if not namespaces: + return name + try: +@@ -421,8 +456,7 @@ def _emit(key, value, content_handler, + return + key, value = result + # Minimal validation to avoid breaking out of tag context +- if _has_angle_brackets(key): +- raise ValueError('Invalid element name: "<" or ">" not allowed') ++ _validate_name(key, "element") + if (not hasattr(value, '__iter__') + or isinstance(value, _basestring) + or isinstance(value, dict)): +@@ -451,23 +485,19 @@ def _emit(key, value, content_handler, + if ik == cdata_key: + cdata = iv + continue +- if ik.startswith(attr_prefix): ++ if isinstance(ik, str) and ik.startswith(attr_prefix): + ik = _process_namespace(ik, namespaces, namespace_separator, + attr_prefix) + if ik == '@xmlns' and isinstance(iv, dict): + for k, v in iv.items(): +- if _has_angle_brackets(k): +- raise ValueError( +- 'Invalid attribute name: "<" or ">" not allowed' +- ) ++ _validate_name(k, "attribute") + attr = 'xmlns{}'.format(':{}'.format(k) if k else '') + attrs[attr] = _unicode(v) + continue + if not isinstance(iv, _unicode): + iv = _unicode(iv) + attr_name = ik[len(attr_prefix) :] +- if _has_angle_brackets(attr_name): +- raise ValueError('Invalid attribute name: "<" or ">" not allowed') ++ _validate_name(attr_name, "attribute") + attrs[attr_name] = iv + continue + children.append((ik, iv)) +-- +2.47.3 + diff -Nru python-xmltodict-0.13.0/debian/patches/0003-Harden-XML-name-validation-reject-quotes-and-add-tes.patch python-xmltodict-0.13.0/debian/patches/0003-Harden-XML-name-validation-reject-quotes-and-add-tes.patch --- python-xmltodict-0.13.0/debian/patches/0003-Harden-XML-name-validation-reject-quotes-and-add-tes.patch 1970-01-01 02:00:00.000000000 +0200 +++ python-xmltodict-0.13.0/debian/patches/0003-Harden-XML-name-validation-reject-quotes-and-add-tes.patch 2026-06-28 20:17:51.000000000 +0300 @@ -0,0 +1,50 @@ +From 02d78e3bf009b479b9d20415cf4c81a5225dc6a0 Mon Sep 17 00:00:00 2001 +From: Martin Blech <[email protected]> +Date: Mon, 8 Sep 2025 11:28:38 -0700 +Subject: Harden XML name validation: reject quotes and '='; add tests + +--- + tests/test_dicttoxml.py | 14 ++++++++++++++ + xmltodict.py | 4 ++++ + 2 files changed, 18 insertions(+) + +diff --git a/tests/test_dicttoxml.py b/tests/test_dicttoxml.py +index 2e74949..9830e2a 100644 +--- a/tests/test_dicttoxml.py ++++ b/tests/test_dicttoxml.py +@@ -305,3 +305,17 @@ xmlns:b="http://b.com/";><x a:attr="val">1</x><a:y>2</a:y><b:z>3</b:z></root>''' + # Whitespace + with self.assertRaises(ValueError): + unparse({"a": {"@xmlns": {"bad prefix": "http://e/"}}}, full_document=False) ++ ++ def test_rejects_names_with_quotes_and_equals(self): ++ # Element names ++ for name in ['a"b', "a'b", "a=b"]: ++ with self.assertRaises(ValueError): ++ unparse({name: "x"}, full_document=False) ++ # Attribute names ++ for name in ['@a"b', "@a'b", "@a=b"]: ++ with self.assertRaises(ValueError): ++ unparse({"a": {name: "x"}}, full_document=False) ++ # xmlns prefixes ++ for prefix in ['a"b', "a'b", "a=b"]: ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {prefix: "http://e/"}}}, full_document=False) +diff --git a/xmltodict.py b/xmltodict.py +index 3531169..788017f 100755 +--- a/xmltodict.py ++++ b/xmltodict.py +@@ -416,6 +416,10 @@ def _validate_name(value, kind): + raise ValueError(f'Invalid {kind} name: "<" or ">" not allowed') + if "/" in value: + raise ValueError(f'Invalid {kind} name: "/" not allowed') ++ if '"' in value or "'" in value: ++ raise ValueError(f"Invalid {kind} name: quotes not allowed") ++ if "=" in value: ++ raise ValueError(f'Invalid {kind} name: "=" not allowed') + if any(ch.isspace() for ch in value): + raise ValueError(f"Invalid {kind} name: whitespace not allowed") + +-- +2.47.3 + diff -Nru python-xmltodict-0.13.0/debian/patches/series python-xmltodict-0.13.0/debian/patches/series --- python-xmltodict-0.13.0/debian/patches/series 1970-01-01 02:00:00.000000000 +0200 +++ python-xmltodict-0.13.0/debian/patches/series 2026-06-28 20:26:01.000000000 +0300 @@ -0,0 +1,3 @@ +0001-Prevent-XML-injection-reject-in-element-attr-names-i.patch +0002-Enhance-unparse-XML-name-validation-with-stricter-ru.patch +0003-Harden-XML-name-validation-reject-quotes-and-add-tes.patch
