Clojure Q&A - Recent questions tagged xml

clojure.data.xml.event: EndElementEvent should provide tag and location-info

Thu, 10 Oct 2024 14:34:39 +0000

Additional information on the EndElementEvent would be very helpful, especially for processing large data in a streaming way.

I would be happy to propose a patch – I've already signed the Contributor Agreement

data.xml : disable support-dtd by default

Mon, 04 Dec 2023 19:14:34 +0000

As defined by OWASP recommendations [1], both supporting-external-entities and support-dtd should be disabled by default.
While it's the case for the former (but not released as part of the 0.0.8 version), it's not the case for the latter.

Can we consider having both defined to false as part of a stable version?

[1] : https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser.

clojure.data.xml.node.Element doesn't implement clojure.lang.Associative/entryAt

Thu, 02 Feb 2023 09:30:55 +0000

Repro:

(find {:tag :a :attrs {} :content ()} :tag)
;;=> [:tag :a]

(find (clojure.data.xml/element :a) :tag)
;;=> Execution error (AbstractMethodError) at clojure.data.xml.node.Element/entryAt (node.cljc:-1).
;;   Method clojure/data/xml/node/Element.entryAt(Ljava/lang/Object;)Lclojure/lang/IMapEntry; is abstract

Having Element implement entryAt would make it possible e.g. to write Malli schemas for clojure.data.xml data structures without having to transform Elements to maps beforehand.

clojure.xml processes XXE by default

Sun, 14 Mar 2021 08:14:34 +0000

clojure.xml by default processes XML external entities. This allows inclusion of external files in the processed XML, both from local file system and from remote servers. This seems like a bad idea when processing untrusted input.

Here's an example that includes /etc/hostname in the result (if you do not have that file on your computer, the result is a FileNotFoundException):

(require 'clojure.xml)

(def xml-str "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY >
  <!ENTITY xxe SYSTEM \"file:///etc/hostname\" >]>
<foo>&xxe;</foo>")

(with-open [input (java.io.ByteArrayInputStream. (.getBytes xml-str))]
  (clojure.xml/parse input))
;; => {:tag :foo, :attrs nil, :content ["nixos\n"]}

As far as I know, this feature is rarely used and e.g. data.xml disables it by default. Could it be disabled in clojure.xml as well to make it safer by default?

Deprecate clojure.xml

Tue, 06 Oct 2020 16:55:11 +0000

The clojure.xml namespace is at this point pretty out of date with modern Java options. It should be marked as deprecated and point to using org.clojure/data.xml instead.