Review: XML Parser Options, Defaults

[xsscx]

Maintainer Summary

2026-05-21 14:48:01 UTC

Issue: XXE

Source of Truth

https://gnome.pages.gitlab.gnome.org/libxml2/html/parser_8h.html

• If you process untrusted data, it's recommended to set ...OPTIONS... to disable loading of Code.

Recent Changes

• Modify: xmlReadFile() at IccProfileXml.cpp:877 & IccMpeXml.cpp:2400 #735
• [IccLibXML] Drop XML_PARSE_HUGE, refuse entity substitution #862
• [IccLibXML] Gate File=/Filename= attribute loaders behind opt-in flag #863

Developer Handoff

• IccXML/IccLibXML/IccProfileXml.cpp :885
• IccXML/IccLibXML/IccMpeXml.cpp :2563

Thank You

[github-actions]

Thanks for opening this issue.

The triage bot added initial labels based on the template and issue text. Maintainers may adjust labels as they review scope, reproduction details, CTest/regression needs, and security impact.

If you have questions, contact a listed Maintainer.

[xsscx]

XML Parser Configuration & Documentation

Request to review iccDEV project XML parser defaults & documentation.

Thank You

[xsscx]

PoC

Before

cd iccDEV
 t=$(mktemp -d); printf 'ICCDEV_XXE_LOCAL_SECRET\n' > "$t/secret.txt"; awk -v s="$t/secret.txt" 'NR==2{print "<!DOCTYPE IccProfile [ <!ENTITY xxe SYSTEM \"file://" s "\"> ]>"} /<\/Header>/{print "    <UnknownHeaderField>&xxe;</UnknownHeaderField>"} {print}' Testing/ICS/Lab_float-D65_2deg-Part1.xml > "$t/xxe.xml"; ASAN_OPTIONS=detect_leaks=0 strace -f -e trace=%file -o "$t/strace.log" Build/Tools/IccFromXml/iccFromXml "$t/xxe.xml" "$t/out.icc" >/dev/null 2>&1; grep -F "$t/secret.txt" "$t/strace.log" && echo "XXE_LOCAL_FILE_OPEN_CONFIRMED" || echo "not observed"; rm -rf "$t"
...
openat(AT_FDCWD, "/tmp/tmp.p3bEjoQSud/secret.txt", O_RDONLY) = 4
XXE_LOCAL_FILE_OPEN_CONFIRMED

After

[2026-05-28 18:50:57 UTC] ~/po/research/iccDEV (issue-1096)$ git branch && echo "---" && git log --oneline -1
  ci-mod-dbz-codeql
* issue-1096
  master
---
c240920 (HEAD -> issue-1096, origin/issue-1096) fix: block XML external entity expansion
[2026-05-28 18:51:10 UTC] ~/po/research/iccDEV (issue-1096)$  t=$(mktemp -d); printf 'ICCDEV_XXE_LOCAL_SECRET\n' > "$t/secret.txt"; awk -v s="$t/secret.txt" 'NR==2{print "<!DOCTYPE IccProfile [ <!ENTITY xxe SYSTEM \"file://" s "\"> ]>"} /<\/Header>/{print "    <UnknownHeaderField>&xxe;</UnknownHeaderField>"} {print}' Testing/ICS/Lab_float-D65_2deg-Part1.xml > "$t/xxe.xml"; ASAN_OPTIONS=detect_leaks=0 strace -f -e trace=%file -o "$t/strace.log" Build/Tools/IccFromXml/iccFromXml "$t/xxe.xml" "$t/out.icc" >/dev/null 2>&1; grep -F "$t/secret.txt" "$t/strace.log" && echo "XXE_LOCAL_FILE_OPEN_CONFIRMED" || echo "not observed"; rm -rf "$t"

not observed