Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-06-10 11:52:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

gh-148954: Escape methodname in xmlrpc.client.dumps() to prevent XML injection (GH-148968)

Browse source
This commit is contained in:
Sanyam Kumat 2026-06-07 03:08:15 +05:30 • committed by GitHub
parent 69851a6407
commit ab930175e7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Lib/test/test_xmlrpc.py
View file

@ -208,6 +208,17 @@ def test_dump_encoding(self):
self.assertEqual(xmlrpclib.loads(strg)[0][0], value)
self.assertEqual(xmlrpclib.loads(strg)[1], methodname)
def test_dump_escape_methodname(self):
payload = 'foo</methodName><injected attr="evil"/><methodName>bar'
s = xmlrpclib.dumps((), methodname=payload)
self.assertIn(
'<methodName>foo&lt;/methodName&gt;&lt;injected attr="evil"/&gt;'
'&lt;methodName&gt;bar</methodName>', s
)
self.assertNotIn('<injected attr="evil"/>', s)
load, m = xmlrpclib.loads(s)
self.assertEqual(m, payload)
def test_dump_bytes(self):
sample = b"my dog has fleas"
self.assertEqual(sample, xmlrpclib.Binary(sample))

2
Lib/xmlrpc/client.py
View file

@ -965,7 +965,7 @@ def dumps(params, methodname=None, methodresponse=None, encoding=None,
data = (
xmlheader,
"<methodCall>\n"
"<methodName>", methodname, "</methodName>\n",
"<methodName>", escape(methodname), "</methodName>\n",
data,
"</methodCall>\n"
)

1
Misc/NEWS.d/next/Library/2026-04-24-19-54-00.gh-issue-148954.v1.rst Normal file
View file

@ -0,0 +1 @@
Fix XML injection vulnerability in :func:`xmlrpc.client.dumps` where the ``methodname`` was not being escaped before interpolation into the XML body.