Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate XInclude depth in XML parsing #2233

Merged
merged 1 commit into from
Feb 17, 2025
Merged

Validate XInclude depth in XML parsing #2233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions source/MaterialXFormat/XmlIo.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ MATERIALX_NAMESPACE_BEGIN

const string MTLX_EXTENSION = "mtlx";

const int MAX_XINCLUDE_DEPTH = 256;
const int MAX_XML_TREE_DEPTH = 256;

namespace
Expand Down Expand Up @@ -161,9 +162,7 @@ void elementToXml(ConstElementPtr elem, xml_node& xmlNode, const XmlWriteOptions

void processXIncludes(DocumentPtr doc, xml_node& xmlNode, const FileSearchPath& searchPath, const XmlReadOptions* readOptions)
{
// Search path for includes. Set empty and then evaluated once in the iteration through xml includes.
FileSearchPath includeSearchPath;

XmlReadFunction readXIncludeFunction = readOptions ? readOptions->readXIncludeFunction : readFromXmlFile;
xml_node xmlChild = xmlNode.first_child();
while (xmlChild)
Expand All @@ -174,15 +173,16 @@ void processXIncludes(DocumentPtr doc, xml_node& xmlNode, const FileSearchPath&
if (readXIncludeFunction)
{
string filename = xmlChild.attribute("href").value();
const StringVec& parents = readOptions ? readOptions->parentXIncludes : StringVec();

// Check for XInclude cycles.
if (readOptions)
// Validate XInclude state.
if (std::find(parents.begin(), parents.end(), filename) != parents.end())
{
const StringVec& parents = readOptions->parentXIncludes;
if (std::find(parents.begin(), parents.end(), filename) != parents.end())
{
throw ExceptionParseError("XInclude cycle detected.");
}
throw ExceptionParseError("XInclude cycle detected.");
}
if (parents.size() >= MAX_XINCLUDE_DEPTH)
{
throw ExceptionParseError("Maximum XInclude depth exceeded.");
}

// Read the included file into a library document.
Expand Down
1 change: 1 addition & 0 deletions source/MaterialXFormat/XmlIo.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ class XmlReadOptions;

extern MX_FORMAT_API const string MTLX_EXTENSION;

extern MX_FORMAT_API const int MAX_XINCLUDE_DEPTH;
extern MX_FORMAT_API const int MAX_XML_TREE_DEPTH;

/// A standard function that reads from an XML file into a Document, with
Expand Down