[bugzilla-gnome-org-upstream/4.4] Bug 1031035: xmlrpc can be DoS'd with billion laughs attack r=LpSolit a=justdave

[Andrea Veri <av src gnome org>]

commit 8beabdc137118042ed436a79501636b31a7ac82d
Author: Byron Jones <glob mozilla com>
Date:   Sat Aug 29 11:46:40 2015 +0200

    Bug 1031035: xmlrpc can be DoS'd with billion laughs attack
    r=LpSolit a=justdave

 Bugzilla/WebService/Server/XMLRPC.pm |    9 +++++++++
 importxml.pl                         |    3 +++
 2 files changed, 12 insertions(+), 0 deletions(-)
---
diff --git a/Bugzilla/WebService/Server/XMLRPC.pm b/Bugzilla/WebService/Server/XMLRPC.pm
index 5f9cb45..266376a 100644
--- a/Bugzilla/WebService/Server/XMLRPC.pm
+++ b/Bugzilla/WebService/Server/XMLRPC.pm
@@ -96,6 +96,15 @@ use Bugzilla::WebService::Constants qw(XMLRPC_CONTENT_TYPE_WHITELIST);
 use Bugzilla::WebService::Util qw(fix_credentials);
 use Scalar::Util qw(tainted);
 
+sub new {
+    my $self = shift->SUPER::new(@_);
+    # Initialise XML::Parser to not expand references to entities, to prevent DoS
+    require XML::Parser;
+    my $parser = XML::Parser->new( NoExpand => 1, Handlers => { Default => sub {} } );
+    $self->{_parser}->parser($parser, $parser);
+    return $self;
+}
+
 sub deserialize {
     my $self = shift;
 
diff --git a/importxml.pl b/importxml.pl
index e7dc976..97c022f 100755
--- a/importxml.pl
+++ b/importxml.pl
@@ -1264,6 +1264,9 @@ my $twig = XML::Twig->new(
     },
     start_tag_handlers => { bugzilla => \&init }
 );
+# Prevent DoS using the billion laughs attack.
+$twig->{NoExpand} = 1;
+
 $twig->parse($xml);
 my $root       = $twig->root;
 my $maintainer = $root->{'att'}->{'maintainer'};