Commit graph

4455 commits

Author SHA1 Message Date
Berkay Eren Ürün
c20ce3aaa3 Fix entity debug order
The fix for entity processing changes the order of opening and closing
of entities. The reason is the new iterative approach that closes
and removes entities as soon as they are fully processed, unlike
the recursive approach that, as a side effect of the recursion, waits
the inner entities before closing and removal.

This commit delays the removal and the call to entityTrackingOnClose
until the current entities inner entities are processed, which in turn
allows us to have the correct debug order again.
2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
16a3b9d356 Merge entity processors 2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
e15cdd6c1f Add test case for nested entities with delayed interpretation 2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
fabae41d28 Fix storeEntityValue recursion 2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
bf97ac5081 Add next pointer to storeEntityValue
This commit introduces a new nextPtr parameter to storeEntityValue.
After finishing its execution, storeEntityValue function sets this
parameter in way that it points to the next token to process.

This is useful when we want to leave and reenter storeEntityValue during
its execution since nextPtr will point where we left.

This commit is base to the following commit.
2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
00fda3c598 Add test case for unbounded entity recursion in attributes 2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
da10ca2328 Break cyclic appendAttributeValue recursion
During processing attributes with entity references,
appendAttributeValue can reach high recursion depths that can lead to
a crash.

This commit switches the processing to an iterative approach similar to
the fix for internal entity processing. A new m_openAttributeEntities
list is introduced to keep track of entity references that need
processing. When a new entity reference is detected, instead of calling
appendAttributeValue recursively, the entity will be added to open
entities list and the execution will return to storeAttributeValue,
where newly added entity will be handled. After the entity processing
is done, appendAttributeValue will be called by using the next token.
2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
74308916d9 Add next pointer to appendAttributeValue
This commits extends appendAttributeValue by introducing a new parameter
that will be set to the next token to process.

Having such a parameter allows us to reenter the function after an exit
and continue from the last token pointed by the pointer.
2025-03-13 14:01:31 +01:00
Sebastian Pipping
0ab49eafae tests: Cover suspend inside nested entites in internalEntityProcessor more 2025-03-13 14:01:31 +01:00
Sebastian Pipping
3679f63dab tests: Cover internalEntityProcessor reentering being finite
The new test asserts that internalEntityProcessor does not loop forever while
processing entities where external entity content references back to internal
entities from the parent document (see &e3; and &e4; below).
We ensure that progress is made after moving the parser from recursive
invocation to a state based processing within function callProcessor.

A version of this test case (originally external-to-Expat, "make run-xmltest")
failed earlier, so we wanted to have a variant of this test (that proved
itself relevant) included within the core test suite ("make check").
2025-03-13 14:01:31 +01:00
Sebastian Pipping
dae1cd5a1b tests: Add support for "CharData *storage" to ExtHdlrData
.. for an upcoming test in a follow-up commit
2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
ad9e140612 Add test cases for unbounded entity recursion 2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
a910fbc0e1 Fix internal entity processing
Co-authored-by: Jann Horn <jannh@google.com>

This avoids unbounded recursion in internal entity processing
2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
6edca2c37e Switch allowClosingDoctype
This change of allowClosingDoctype has no effect and only serves as a
preparation for the upcoming changes.
2025-03-13 14:01:31 +01:00
Berkay Eren Ürün
5e16cd6d07 Introduce reenter flag
Co-authored-by: Jann Horn <jannh@google.com>

Add a new reenter flag. This flag acts like XML_SUSPENDED,
except that instead of returning out of the library, we
only return back to the main parse function, then re-enter
the processor function.
2025-03-13 14:01:31 +01:00
Jann Horn
dd982e3950 Refactor guards against busy parser reconfiguration
Rebased-and-adapted-by: Berkay Eren Ürün <berkay.ueruen@siemens.com>
2025-03-13 14:01:31 +01:00
Sebastian Pipping
2fc3683333
Merge pull request #972 from libexpat/robustify-flaky-xml-validation-ci
`valid-xml.yml`: Stop `xmllint` from loading DTD from the internet to address flaky CI
2025-03-13 04:27:19 +01:00
Sebastian Pipping
0165a43876 valid-xml.yml: Stop xmllint from loading DTD from the internet
.. to address flaky CI
2025-03-13 03:45:25 +01:00
Sebastian Pipping
07108642fe
Merge pull request #970 from hannob-forks/https2
Update links in code comments to HTTPS
2025-03-07 16:24:41 +01:00
Hanno Böck
87fb1a42f0 Update links in code comments to https 2025-03-07 08:42:42 +01:00
Sebastian Pipping
c92b51b6a9
Merge pull request #971 from libexpat/address-cppcheck-warnings
Address Cppcheck warnings + fix Cppcheck CI
2025-03-07 04:28:36 +01:00
Sebastian Pipping
24aa9b8c49 Changes: Document #971 2025-03-07 03:06:30 +01:00
Sebastian Pipping
b8ab03d2da cppcheck.yml: Ensure latest Cppcheck from macOS Homebrew 2025-03-07 03:06:27 +01:00
Sebastian Pipping
ba7853edef tests: Address Cppcheck 2.17.1 warning about malloc returning NULL 2025-03-07 03:06:24 +01:00
Sebastian Pipping
688483ee3b mass-cppcheck.sh: Make Cppcheck pass check for __attribute__((noreturn))
Related:
https://sourceforge.net/p/cppcheck/discussion/general/thread/acbae4ae20/
https://sourceforge.net/p/cppcheck/discussion/general/thread/2f5d2766/
2025-03-07 03:06:21 +01:00
Sebastian Pipping
6620f6f40a tests/minicheck: Use more portable check for __attribute__((noreturn))
Related:
https://gcc.gnu.org/onlinedocs/cpp/_005f_005fhas_005fattribute.html
2025-03-07 03:06:21 +01:00
Sebastian Pipping
401e6d4f49 tests/benchmark: Address Cppcheck 2.17.1 warning about malloc returning NULL 2025-03-07 03:06:18 +01:00
Sebastian Pipping
03fa6fa576
Merge pull request #969 from hannob-forks/https1
Update Open Group link/comment to HTTPS
2025-03-04 23:13:47 +01:00
Hanno Böck
afd87e8399 Update opengroup link/comment to https 2025-03-04 22:24:28 +01:00
Sebastian Pipping
660e48b0a3
Merge pull request #966 from libexpat/leverage-cmake-3-13
Leverage CMake >=3.13
2025-02-26 02:34:15 +01:00
Sebastian Pipping
2e122561fd Changes: Document #966 2025-02-26 01:24:52 +01:00
Sebastian Pipping
d701205f81 CMake: Make use of target_link_options of CMake >=3.13 2025-02-26 01:24:52 +01:00
Sebastian Pipping
a111fa867f
Merge pull request #964 from libexpat/coverity-scan-disable-for-forks
Stop (trying to) upload to Coverity Scan from fork repositories
2025-02-25 18:18:00 +01:00
Sebastian Pipping
da47494e44 Changes: Document #964 2025-02-25 05:56:40 +01:00
Sebastian Pipping
27046f2376 coverity-scan.yml: Do not run in fork repositories 2025-02-25 05:56:37 +01:00
Sebastian Pipping
2785661a04
Merge pull request #958 from libexpat/extend-changelog
Extend changelog (i.e. early bits of preparation for release 2.6.5)
2025-02-24 17:53:57 +01:00
Sebastian Pipping
f5c915ae13
Merge pull request #963 from libexpat/dependabot/github_actions/actions/upload-artifact-4.6.1
Actions(deps): Bump actions/upload-artifact from 4.6.0 to 4.6.1
2025-02-24 17:39:50 +01:00
dependabot[bot]
01b453af3a
Actions(deps): Bump actions/upload-artifact from 4.6.0 to 4.6.1
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.0 to 4.6.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](65c4c4a1dd...4cec3d8aa0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-02-24 15:07:44 +00:00
Sebastian Pipping
7f9a144507
Merge pull request #962 from libexpat/require-cmake-3-13
Drop support for CMake <3.13
2025-02-23 21:00:49 +01:00
Sebastian Pipping
b91c28f375 Changes: Document more changes since release Expat 2.6.4 2025-02-23 16:49:47 +01:00
Sebastian Pipping
6fe87b6116 Drop support for CMake <3.13
Because libprotobuf-mutator with tests enabled already
needs CMake >=3.13 in practice
(https://github.com/google/libprotobuf-mutator/pull/276).

PS: Near-end-of-life Ubuntu "focal" 20.04 LTS has
CMake 3.16.3 (https://packages.ubuntu.com/focal/cmake)
and Debian "bullseye" old(!)stable has CMake 3.18.4
(https://packages.debian.org/bullseye/cmake).
2025-02-23 16:43:38 +01:00
Sebastian Pipping
c659edbd2b
Merge pull request #961 from libexpat/fuzzers-re-enable-xml-lpm-fuzzer-for-oss-fuzz
fuzzers|cmake: Re-enable `xml_lpm_fuzzer` for `-DEXPAT_OSSFUZZ_BUILD=ON`
2025-02-23 05:21:23 +01:00
Sebastian Pipping
9bfccc4b13 fuzzers|cmake: Forward to libprotobuf-mutator with Ubuntu 20.04 support 2025-02-23 04:40:37 +01:00
Sebastian Pipping
ae1fc71ebb fuzzers|cmake: Use proper library order for linking xml_lpm_fuzzer 2025-02-23 04:40:21 +01:00
Sebastian Pipping
cf28b6de98 Revert "fuzzers|cmake: Disable xml_lpm_fuzzer for -DEXPAT_OSSFUZZ_BUILD=ON"
This reverts commit 392fb29e67.
2025-02-23 04:25:24 +01:00
Sebastian Pipping
e89dc4e7a3
Merge pull request #960 from libexpat/coverity-scan-upload
Submit a build to Coverity Scan for static analysis
2025-02-22 16:53:16 +01:00
Sebastian Pipping
d9f802ea8d Submit a build to Coverity Scan for static analysis 2025-02-22 16:10:18 +01:00
Sebastian Pipping
ca7321b9fc
Merge pull request #959 from libexpat/tests-benchmark-improve
`tests/benchmark`: Fix a harmless TOCTTOU + upfront refactorings + improve error messages
2025-02-22 16:08:31 +01:00
Sebastian Pipping
7f5903483e tests/benchmark: Make error messages more technical 2025-02-21 23:31:32 +01:00
Sebastian Pipping
ead919d692 tests/benchmark: Resolve (harmless) TOCTTOU
.. that was reported by Coverity Scan.

https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use
2025-02-21 23:31:32 +01:00