mirror of
https://github.com/github/codeql.git
synced 2026-08-03 17:03:02 +02:00
24 lines
603 B
Ruby
24 lines
603 B
Ruby
require 'xml'
|
|
require 'libxml'
|
|
|
|
# Change the ActiveSupport XML backend from REXML to LibXML
|
|
ActiveSupport::XmlMini.backend = 'LibXML'
|
|
|
|
# Allow entity replacement in LibXML parsing
|
|
LibXML::XML.class_eval do
|
|
def self.default_substitute_entities
|
|
XML.default_substitute_entities = true
|
|
end
|
|
end
|
|
|
|
class LibXmlRubyXXE < ApplicationController
|
|
def foo
|
|
content = params[:xml] # $ Source
|
|
|
|
LibXML::XML::Parser.file(content, { options: 2048 }) # $ Alert
|
|
Hash.from_xml(content) # $ Alert
|
|
Hash.from_trusted_xml(content) # $ Alert
|
|
ActiveSupport::XmlMini.parse(content) # $ Alert
|
|
end
|
|
end
|