fix(security): bump lxml para 6.1.1, corrige XXE de leitura de arquivo local (fase 4, #1251)

packtools/sps/pid_provider/xml_loader.py

@@ -83,7 +83,7 @@ def xml_parser_ent2char(xml):
     ao invés de convertidas para seus caracteres correspondentes.
     """
     try:
-        parser = etree.XMLParser(recover=True, encoding="utf-8")
+        parser = etree.XMLParser(recover=True, encoding="utf-8", resolve_entities="internal")
         root = etree.fromstring(xml, parser)
         return etree.tostring(root, method="xml", encoding="utf-8").decode("utf-8")
     except Exception as e:

packtools/sps/utils/xml_utils.py

@@ -43,6 +43,12 @@ def process_xref(node, footnote_markers=None):
             _next = xref.getnext()
             if _next is None or _next.tag != "xref":
                 e = etree.Element("EMPTYTAGTOKEEPXREFTAIL")
+                # Move o tail explicitamente antes do addnext: em lxml >= 5,
+                # addnext() deixou de transferir o tail automaticamente para
+                # o elemento inserido, o que fazia parent.remove(xref) (abaixo)
+                # descartar esse texto junto com o xref removido.
+                e.tail = xref.tail
+                xref.tail = None
                 xref.addnext(e)
 
     for xref in node.findall(".//xref"):
@@ -138,7 +144,7 @@ def _get_xml_content(xml):
 
 
 def get_xml_tree(content):
-    parser = etree.XMLParser(remove_blank_text=True, no_network=True)
+    parser = etree.XMLParser(remove_blank_text=True, no_network=True, resolve_entities="internal")
     try:
         content = _get_xml_content(content)
         xml_tree = etree.XML(content, parser)

packtools/utils.py

@@ -31,11 +31,11 @@
 
 try:
     # available on lxml >= 3.4.0
-    NOIDS_XMLPARSER = etree.XMLParser(collect_ids=False)
+    NOIDS_XMLPARSER = etree.XMLParser(collect_ids=False, resolve_entities="internal")
 except TypeError:
     LOGGER.info('cannot instantiate an XML parser that avoids the collection '
                 'of ids from elements.')
-    NOIDS_XMLPARSER = etree.XMLParser()
+    NOIDS_XMLPARSER = etree.XMLParser(resolve_entities="internal")
 
 
 def setdefault(object, attribute, producer):
@@ -96,7 +96,8 @@ def XML(file, no_network=True, load_dtd=True):
     """
     parser = etree.XMLParser(remove_blank_text=True,
                              load_dtd=load_dtd,
-                             no_network=no_network)
+                             no_network=no_network,
+                             resolve_entities="internal")
     xml = etree.parse(file, parser)
 
     return xml

requirements.txt

@@ -1,5 +1,5 @@
 urllib3==2.2.2
-lxml==4.9.3
+lxml==6.1.1
 Pillow==10.1.0
 minio==7.2.0
 requests==2.32.0

setup.py

@@ -49,7 +49,7 @@ def run(self):
 
 INSTALL_REQUIRES = [
     'aiohttp>=3.9.1',
-    'lxml>=4.9.2',
+    'lxml>=6.1.0',
     'langcodes>=3.3.0',
     'langdetect>=1.0.9',
     'picles.plumber>=0.11',

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = {py39,py310,py311}-lxml{492}
+envlist = {py39,py310,py311}-lxml{611}
 
 [testenv]
 isolated_build=true
@@ -8,7 +8,7 @@ basepython =
     py310: python3.10
     py311: python3.11
 deps =
-    lxml492: lxml==4.9.2
+    lxml611: lxml==6.1.1
     Flask-Testing
     flask-babel
     python-magic