Skip to content

Commit 88c770b

Browse files
JanKallmanJanKallman
authored
Bug/dtd fix (#2583)
* Added prohibit dtd to external reference document read * Created new method for creating XmlReader's with DTD prohibited * Several fixes for GHSA-f4h2-2r6m-w59r * Updated System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs to address vulnerabilities. * Added more fixes in CrtxTemplateHelper and ImageReader
1 parent a7fe1e1 commit 88c770b

10 files changed

Lines changed: 35 additions & 31 deletions

File tree

‎src/Directory.Packages.props‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
<PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
88
<PackageVersion Include="MSTest" Version="3.10.2" />
99
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
10-
<PackageVersion Include="System.Drawing.Common" Version="8.0.26" />
10+
<PackageVersion Include="System.Drawing.Common" Version="8.0.32" />
1111
<PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
12-
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
13-
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.4" />
12+
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.2" />
13+
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.5" />
1414
<PackageVersion Include="System.Text.Encoding.CodePages" Version="8.0.0" />
1515
<PackageVersion Include="System.Text.Json" Version="8.0.6" />
1616
</ItemGroup>

‎src/EPPlus/DigitalSignatures/ExcelDigitalSignature.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ internal ExcelDigitalSignature(ExcelWorkbook wb, XmlNamespaceManager ns, ZipPack
127127
PreserveWhitespace = true,
128128
};
129129
//Full read only REALLY relevant for verification of signature
130-
_doc.Load(part.GetStream());
130+
LoadXmlSafe(_doc, part.GetStream());
131131
var isVerified = IsValid;
132132

133133
//Read signing method

‎src/EPPlus/Drawing/Chart/Style/CrtxTemplateHelper.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ internal static void LoadCrtx(Stream stream, out XmlDocument chartXml, out XmlDo
4141
{
4242
var chartPart = p.GetPart(chartRel.TargetUri);
4343
chartXml = new XmlDocument();
44-
chartXml.Load(chartPart.GetStream());
44+
XmlHelper.LoadXmlSafe(chartXml, chartPart.GetStream());
4545
var rels = chartPart.GetRelationships();
4646
foreach (var rel in rels)
4747
{
@@ -53,11 +53,11 @@ internal static void LoadCrtx(Stream stream, out XmlDocument chartXml, out XmlDo
5353
break;
5454
case ExcelPackage.schemaChartStyleRelationships:
5555
styleXml = new XmlDocument();
56-
styleXml.Load(part.GetStream());
56+
XmlHelper.LoadXmlSafe(styleXml, chartPart.GetStream());
5757
break;
5858
case ExcelPackage.schemaChartColorStyleRelationships:
5959
colorsXml = new XmlDocument();
60-
colorsXml.Load(part.GetStream());
60+
XmlHelper.LoadXmlSafe(colorsXml, chartPart.GetStream());
6161
break;
6262
}
6363
}

‎src/EPPlus/Drawing/Chart/Style/ExcelChartStyleManager.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -996,7 +996,7 @@ private ZipPackageRelationship CreateThemeOverridePart(ZipPackage p, ZipPackageP
996996
ThemeOverridePart = p.CreatePart(ThemeOverrideUri, ContentTypes.contentTypeThemeOverride);
997997

998998
ThemeOverrideXml = new XmlDocument();
999-
ThemeOverrideXml.Load(partToCopy.GetStream());
999+
LoadXmlSafe(ThemeOverrideXml, partToCopy.GetStream());
10001000

10011001
foreach (var themeRel in partToCopy.GetRelationships())
10021002
{

‎src/EPPlus/Drawing/ImageHandling/ImageReader.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -769,7 +769,7 @@ private static bool IsSvg(MemoryStream ms, ref double width, ref double height)
769769
{
770770
try
771771
{
772-
var reader = new XmlTextReader(ms);
772+
var reader = XmlHelper.CreateXmlReaderSafe(ms);
773773
while (reader.Read())
774774
{
775775
if (reader.LocalName == "svg" && reader.NodeType == XmlNodeType.Element)
@@ -816,7 +816,7 @@ private static bool IsSvg(MemoryStream ms)
816816
try
817817
{
818818
ms.Position = 0;
819-
var reader = new XmlTextReader(ms);
819+
var reader = XmlHelper.CreateXmlReaderSafe(ms);
820820
while (reader.Read())
821821
{
822822
if (reader.LocalName == "svg" && reader.NodeType == XmlNodeType.Element)

‎src/EPPlus/Drawing/Theme/ExcelThemeManager.cs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ Date Author Change
2020
using System;
2121
using System.IO;
2222
using System.Linq;
23+
using System.Text;
2324
using System.Xml;
2425

2526
namespace OfficeOpenXml.Drawing.Theme
@@ -79,8 +80,8 @@ public void CreateDefaultTheme()
7980
_defaultTheme = StyleResourceManager.GetItem("defaulttheme2022.Xml");
8081
}
8182
}
82-
var themeXml = new XmlDocument();
83-
themeXml.LoadXml(_defaultTheme);
83+
var themeXml = new XmlDocument();
84+
XmlHelper.LoadXmlSafe(themeXml, _defaultTheme, Encoding.UTF8);
8485
Load(themeXml);
8586
}
8687
internal ExcelTheme GetOrCreateTheme()

‎src/EPPlus/EPPlus.csproj‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -803,20 +803,20 @@
803803
</ItemGroup>
804804

805805
<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
806-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.18" />
806+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.21" />
807807
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
808-
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.18" />
808+
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.21" />
809809
<PackageReference Include="System.ComponentModel.Annotations" />
810-
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.18" />
811-
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.18" />
810+
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.21" />
811+
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.21" />
812812
</ItemGroup>
813813
<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
814-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.10" />
814+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.13" />
815815
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
816-
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.10" />
816+
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.13" />
817817
<PackageReference Include="System.ComponentModel.Annotations" />
818-
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.10" />
819-
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.10" />
818+
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.13" />
819+
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.13" />
820820
</ItemGroup>
821821
<ItemGroup>
822822
<Compile Remove="LoadFunctions\HeaderReader.cs" />

‎src/EPPlus/ExcelWorkbook.cs‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -365,16 +365,7 @@ private void GetSharedStrings()
365365
if (_package.ZipPackage.PartExists(SharedStringsUri))
366366
{
367367
Packaging.ZipPackagePart part = _package.ZipPackage.GetPart(SharedStringsUri);
368-
#if Core
369-
var xr = XmlReader.Create(part.GetStream(), new XmlReaderSettings()
370-
{
371-
DtdProcessing = DtdProcessing.Prohibit,
372-
IgnoreWhitespace = true,
373-
});
374-
375-
#else
376-
var xr = new XmlTextReader(part.GetStream());
377-
#endif
368+
var xr = XmlHelper.CreateXmlReaderSafe(part.GetStream(), WhitespaceHandling.Significant);
378369
int index = 0;
379370
while (xr.Read())
380371
{

‎src/EPPlus/ExternalReferences/ExcelExternalLinksCollection.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ internal void LoadExternalReferences()
9898
string rID = elem.GetAttribute("id",ExcelPackage.schemaRelationships);
9999
var rel = _wb.Part.GetRelationship(rID);
100100
var part = _wb._package.ZipPackage.GetPart(UriHelper.ResolvePartUri(rel.SourceUri, rel.TargetUri));
101-
var xr = new XmlTextReader(part.GetStream());
101+
var xr = XmlHelper.CreateXmlReaderSafe(part.GetStream());
102102
while (xr.Read())
103103
{
104104
if (xr.NodeType == XmlNodeType.Element)

‎src/EPPlus/XmlHelper.cs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1435,6 +1435,18 @@ internal static void LoadXmlSafe(XmlDocument xmlDoc, Stream stream)
14351435
XmlReader reader = XmlReader.Create(sr, settings);
14361436
xmlDoc.Load(reader);
14371437
}
1438+
internal static XmlTextReader CreateXmlReaderSafe(Stream stream, WhitespaceHandling whitespaceHandling=WhitespaceHandling.All)
1439+
{
1440+
var xr = new XmlTextReader(stream);
1441+
xr.WhitespaceHandling = whitespaceHandling;
1442+
#if (NET35)
1443+
xr.ProhibitDtd = true;
1444+
#else
1445+
xr.DtdProcessing = DtdProcessing.Prohibit;
1446+
#endif
1447+
return xr;
1448+
}
1449+
14381450
internal static void LoadXmlSafe(XmlDocument xmlDoc, string xml, Encoding encoding)
14391451
{
14401452
using (var stream = EPPlusMemoryManager.GetStream(encoding.GetBytes(xml)))

0 commit comments

Comments
 (0)