From 6c70a5e66caaf05685702ff250b2eb403d275b77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Mon, 17 Aug 2026 11:59:56 -0300
Subject: [PATCH] fix(xcatd): block XML external entities on the legacy parser
 path

xCAT::XML wraps XML::Simple. It blocks XML external entities. An external
entity can read a local file or a network resource.

XML::Simple with new_xml_parser() installs an ExternEnt handler. The
handler returns the system id, not the content.

XML::Simple 2.20 to 2.24 has no new_xml_parser(). On these versions xCAT
uses build_tree_xml_parser() instead. This function did not install the
handler. A SYSTEM entity then expanded. It leaked a local file into the
parsed data.

This change adds the same handler to build_tree_xml_parser(). Both paths
pass parser options in an array reference. XML::Parser->new ignores that
reference. The handler is therefore the real defense. This fix keeps
#6917, which retains the compatibility path for those releases.

This fix was recovered from the lenovobuild branch. See PR #6505.
---
 xCAT-server/lib/perl/xCAT/XML.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xCAT-server/lib/perl/xCAT/XML.pm b/xCAT-server/lib/perl/xCAT/XML.pm
index 972b331d2..9c3a2afdc 100644
--- a/xCAT-server/lib/perl/xCAT/XML.pm
+++ b/xCAT-server/lib/perl/xCAT/XML.pm
@@ -56,6 +56,7 @@ sub build_tree_xml_parser {
                                no_network => 1,
                                expand_entities => 0,
                              ]);
+  $xp->setHandlers(ExternEnt => sub { return $_[2] });
   my($tree);
   if($filename) {
       # $tree = $xp->parsefile($filename);  # Changed due to prob w/mod_perl