diff -pruN 0.13.0-1/debian/changelog 0.13.0-1ubuntu1/debian/changelog --- 0.13.0-1/debian/changelog 2022-08-29 21:16:25.000000000 +0000 +++ 0.13.0-1ubuntu1/debian/changelog 2025-09-15 18:52:11.000000000 +0000 @@ -1,3 +1,12 @@ +python-xmltodict (0.13.0-1ubuntu1) questing; urgency=medium + + * SECURITY UPDATE: XML Injection when inserting XML tags. + - debian/patches/CVE-2025-9375-*.patch: Add checks for special characters + in xmltodict.py. + - CVE-2025-9375 + + -- Hlib Korzhynskyy Mon, 15 Sep 2025 16:22:11 -0230 + python-xmltodict (0.13.0-1) unstable; urgency=medium * New upstream version 0.13.0 diff -pruN 0.13.0-1/debian/control 0.13.0-1ubuntu1/debian/control --- 0.13.0-1/debian/control 2022-08-29 21:16:25.000000000 +0000 +++ 0.13.0-1ubuntu1/debian/control 2025-09-15 18:52:11.000000000 +0000 @@ -1,7 +1,8 @@ Source: python-xmltodict Section: python Priority: optional -Maintainer: Sebastien Badia +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Sebastien Badia Build-Depends: debhelper-compat (= 13), dh-python, python3-all, diff -pruN 0.13.0-1/debian/patches/CVE-2025-9375-1.patch 0.13.0-1ubuntu1/debian/patches/CVE-2025-9375-1.patch --- 0.13.0-1/debian/patches/CVE-2025-9375-1.patch 1970-01-01 00:00:00.000000000 +0000 +++ 0.13.0-1ubuntu1/debian/patches/CVE-2025-9375-1.patch 2025-09-15 18:52:11.000000000 +0000 @@ -0,0 +1,106 @@ +Backport of: + +From ecd456ab88d379514b116ef9293318b74e5ed3ee Mon Sep 17 00:00:00 2001 +From: Martin Blech <78768+martinblech@users.noreply.github.com> +Date: Thu, 4 Sep 2025 17:25:39 -0700 +Subject: [PATCH] Prevent XML injection: reject '<'/'>' in element/attr names + (incl. @xmlns) + +* Add tests for tag names, attribute names, and @xmlns prefixes; confirm attr values are escaped. + +#377 +--- + tests/test_dicttoxml.py | 32 ++++++++++++++++++++++++++++++++ + xmltodict.py | 20 +++++++++++++++++++- + 2 files changed, 51 insertions(+), 1 deletion(-) + +Index: python-xmltodict-0.13.0/tests/test_dicttoxml.py +=================================================================== +--- python-xmltodict-0.13.0.orig/tests/test_dicttoxml.py ++++ python-xmltodict-0.13.0/tests/test_dicttoxml.py +@@ -213,3 +213,35 @@ xmlns:b="http://b.com/"> + expected_xml = '\nfalse' + xml = unparse(dict(x=False)) + self.assertEqual(xml, expected_xml) ++ ++ def test_rejects_tag_name_with_angle_brackets(self): ++ # Minimal guard: disallow '<' or '>' to prevent breaking tag context ++ with self.assertRaises(ValueError): ++ unparse({"m>contentcontent2", "#text": "x"}}, full_document=False) ++ # The generated XML should contain escaped '<' and '>' within the attribute value ++ self.assertIn('attr="1<middle>2"', xml) +Index: python-xmltodict-0.13.0/xmltodict.py +=================================================================== +--- python-xmltodict-0.13.0.orig/xmltodict.py ++++ python-xmltodict-0.13.0/xmltodict.py +@@ -379,6 +379,14 @@ def parse(xml_input, encoding=None, expa + return handler.item + + ++def _has_angle_brackets(value): ++ """Return True if value (a str) contains '<' or '>'. ++ ++ Non-string values return False. Uses fast substring checks implemented in C. ++ """ ++ return isinstance(value, str) and ("<" in value or ">" in value) ++ ++ + def _process_namespace(name, namespaces, ns_sep=':', attr_prefix='@'): + if not namespaces: + return name +@@ -412,6 +420,9 @@ def _emit(key, value, content_handler, + if result is None: + return + key, value = result ++ # Minimal validation to avoid breaking out of tag context ++ if _has_angle_brackets(key): ++ raise ValueError('Invalid element name: "<" or ">" not allowed') + if (not hasattr(value, '__iter__') + or isinstance(value, _basestring) + or isinstance(value, dict)): +@@ -445,12 +456,19 @@ def _emit(key, value, content_handler, + attr_prefix) + if ik == '@xmlns' and isinstance(iv, dict): + for k, v in iv.items(): ++ if _has_angle_brackets(k): ++ raise ValueError( ++ 'Invalid attribute name: "<" or ">" not allowed' ++ ) + attr = 'xmlns{}'.format(':{}'.format(k) if k else '') + attrs[attr] = _unicode(v) + continue + if not isinstance(iv, _unicode): + iv = _unicode(iv) +- attrs[ik[len(attr_prefix):]] = iv ++ attr_name = ik[len(attr_prefix) :] ++ if _has_angle_brackets(attr_name): ++ raise ValueError('Invalid attribute name: "<" or ">" not allowed') ++ attrs[attr_name] = iv + continue + children.append((ik, iv)) + if pretty: diff -pruN 0.13.0-1/debian/patches/CVE-2025-9375-2.patch 0.13.0-1ubuntu1/debian/patches/CVE-2025-9375-2.patch --- 0.13.0-1/debian/patches/CVE-2025-9375-2.patch 1970-01-01 00:00:00.000000000 +0000 +++ 0.13.0-1ubuntu1/debian/patches/CVE-2025-9375-2.patch 2025-09-15 18:52:11.000000000 +0000 @@ -0,0 +1,170 @@ +Backport of: + +From f98c90f071228ed73df997807298e1df4f790c33 Mon Sep 17 00:00:00 2001 +From: Martin Blech <78768+martinblech@users.noreply.github.com> +Date: Mon, 8 Sep 2025 11:18:33 -0700 +Subject: [PATCH] Enhance unparse() XML name validation with stricter rules and + tests + +Extend existing validation (previously only for "<" and ">") to also +reject element, attribute, and xmlns prefix names that are non-string, +start with "?" or "!", or contain "/", spaces, tabs, or newlines. +Update _emit and namespace handling to use _validate_name. Add tests +covering these new invalid name cases. +--- + tests/test_dicttoxml.py | 60 +++++++++++++++++++++++++++++++++++++++++ + xmltodict.py | 48 ++++++++++++++++++++++++++------- + 2 files changed, 99 insertions(+), 9 deletions(-) + +Index: python-xmltodict-0.13.0/tests/test_dicttoxml.py +=================================================================== +--- python-xmltodict-0.13.0.orig/tests/test_dicttoxml.py ++++ python-xmltodict-0.13.0/tests/test_dicttoxml.py +@@ -245,3 +245,63 @@ xmlns:b="http://b.com/"> + xml = unparse({"a": {"@attr": "12", "#text": "x"}}, full_document=False) + # The generated XML should contain escaped '<' and '>' within the attribute value + self.assertIn('attr="1<middle>2"', xml) ++ ++ def test_rejects_tag_name_starting_with_question(self): ++ with self.assertRaises(ValueError): ++ unparse({"?pi": "data"}, full_document=False) ++ ++ def test_rejects_tag_name_starting_with_bang(self): ++ with self.assertRaises(ValueError): ++ unparse({"!decl": "data"}, full_document=False) ++ ++ def test_rejects_attribute_name_starting_with_question(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@?weird": "x"}}, full_document=False) ++ ++ def test_rejects_attribute_name_starting_with_bang(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@!weird": "x"}}, full_document=False) ++ ++ def test_rejects_xmlns_prefix_starting_with_question_or_bang(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"?p": "http://e/"}}}, full_document=False) ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"!p": "http://e/"}}}, full_document=False) ++ ++ def test_rejects_non_string_names(self): ++ class Weird: ++ def __str__(self): ++ return "bad>name" ++ ++ # Non-string element key ++ with self.assertRaises(ValueError): ++ unparse({Weird(): "x"}, full_document=False) ++ # Non-string attribute key ++ with self.assertRaises(ValueError): ++ unparse({"a": {Weird(): "x"}}, full_document=False) ++ ++ def test_rejects_tag_name_with_slash(self): ++ with self.assertRaises(ValueError): ++ unparse({"bad/name": "x"}, full_document=False) ++ ++ def test_rejects_tag_name_with_whitespace(self): ++ for name in ["bad name", "bad\tname", "bad\nname"]: ++ with self.assertRaises(ValueError): ++ unparse({name: "x"}, full_document=False) ++ ++ def test_rejects_attribute_name_with_slash(self): ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@bad/name": "x"}}, full_document=False) ++ ++ def test_rejects_attribute_name_with_whitespace(self): ++ for name in ["@bad name", "@bad\tname", "@bad\nname"]: ++ with self.assertRaises(ValueError): ++ unparse({"a": {name: "x"}}, full_document=False) ++ ++ def test_rejects_xmlns_prefix_with_slash_or_whitespace(self): ++ # Slash ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"bad/prefix": "http://e/"}}}, full_document=False) ++ # Whitespace ++ with self.assertRaises(ValueError): ++ unparse({"a": {"@xmlns": {"bad prefix": "http://e/"}}}, full_document=False) +Index: python-xmltodict-0.13.0/xmltodict.py +=================================================================== +--- python-xmltodict-0.13.0.orig/xmltodict.py ++++ python-xmltodict-0.13.0/xmltodict.py +@@ -387,7 +387,42 @@ def _has_angle_brackets(value): + return isinstance(value, str) and ("<" in value or ">" in value) + + ++def _has_invalid_name_chars(value): ++ """Return True if value (a str) contains any disallowed name characters. ++ ++ Disallowed: '<', '>', '/', or any whitespace character. ++ Non-string values return False. ++ """ ++ if not isinstance(value, str): ++ return False ++ if "<" in value or ">" in value or "/" in value: ++ return True ++ # Check for any whitespace (spaces, tabs, newlines, etc.) ++ return any(ch.isspace() for ch in value) ++ ++ ++def _validate_name(value, kind): ++ """Validate an element/attribute name for XML safety. ++ ++ Raises ValueError with a specific reason when invalid. ++ ++ kind: 'element' or 'attribute' (used in error messages) ++ """ ++ if not isinstance(value, str): ++ raise ValueError(f"{kind} name must be a string") ++ if value.startswith("?") or value.startswith("!"): ++ raise ValueError(f'Invalid {kind} name: cannot start with "?" or "!"') ++ if "<" in value or ">" in value: ++ raise ValueError(f'Invalid {kind} name: "<" or ">" not allowed') ++ if "/" in value: ++ raise ValueError(f'Invalid {kind} name: "/" not allowed') ++ if any(ch.isspace() for ch in value): ++ raise ValueError(f"Invalid {kind} name: whitespace not allowed") ++ ++ + def _process_namespace(name, namespaces, ns_sep=':', attr_prefix='@'): ++ if not isinstance(name, str): ++ return name + if not namespaces: + return name + try: +@@ -421,8 +456,7 @@ def _emit(key, value, content_handler, + return + key, value = result + # Minimal validation to avoid breaking out of tag context +- if _has_angle_brackets(key): +- raise ValueError('Invalid element name: "<" or ">" not allowed') ++ _validate_name(key, "element") + if (not hasattr(value, '__iter__') + or isinstance(value, _basestring) + or isinstance(value, dict)): +@@ -451,23 +485,19 @@ def _emit(key, value, content_handler, + if ik == cdata_key: + cdata = iv + continue +- if ik.startswith(attr_prefix): ++ if isinstance(ik, str) and ik.startswith(attr_prefix): + ik = _process_namespace(ik, namespaces, namespace_separator, + attr_prefix) + if ik == '@xmlns' and isinstance(iv, dict): + for k, v in iv.items(): +- if _has_angle_brackets(k): +- raise ValueError( +- 'Invalid attribute name: "<" or ">" not allowed' +- ) ++ _validate_name(k, "attribute") + attr = 'xmlns{}'.format(':{}'.format(k) if k else '') + attrs[attr] = _unicode(v) + continue + if not isinstance(iv, _unicode): + iv = _unicode(iv) + attr_name = ik[len(attr_prefix) :] +- if _has_angle_brackets(attr_name): +- raise ValueError('Invalid attribute name: "<" or ">" not allowed') ++ _validate_name(attr_name, "attribute") + attrs[attr_name] = iv + continue + children.append((ik, iv)) diff -pruN 0.13.0-1/debian/patches/series 0.13.0-1ubuntu1/debian/patches/series --- 0.13.0-1/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ 0.13.0-1ubuntu1/debian/patches/series 2025-09-15 18:52:11.000000000 +0000 @@ -0,0 +1,2 @@ +CVE-2025-9375-1.patch +CVE-2025-9375-2.patch