Skip to content

Commit

Permalink
fix: Exit gracefully on sourcecode src file access errors
Browse files Browse the repository at this point in the history
Fixes #1125
  • Loading branch information
kesara committed Jan 23, 2025
1 parent cadcea7 commit c4a4a0e
Showing 1 changed file with 8 additions and 4 deletions.
12 changes: 8 additions & 4 deletions xml2rfc/writers/preptool.py
Original file line number Diff line number Diff line change
Expand Up @@ -1719,12 +1719,15 @@ def check_src_file_path(self, e, scheme, netloc, path, query, fragment):
dir = os.path.abspath(os.path.dirname(self.xmlrfc.source))
path = os.path.abspath(os.path.join(dir, path))
if not path.startswith(dir):
self.die(e, "Expected an <%s> src= file located beside or below the .xml source (in %s), but found a reference to %s" % (e.tag, dir, path))
self.err(e, "Expected an <%s> src= file located beside or below the .xml source (in %s), but found a reference to %s" % (e.tag, dir, path))
return None
src = urlunsplit((scheme, '', path, '', ''))
if shellmeta.search(src):
self.die(e, "Found disallowed shell meta-characters in the src='file:...' attribute")
self.err(e, "Found disallowed shell meta-characters in the src='file:...' attribute")
return None
if not os.path.exists(path):
self.die(e, "Expected an <%s> src= file at '%s', but no such file exists" % (e.tag, path, ))
self.err(e, "Expected an <%s> src= file at '%s', but no such file exists" % (e.tag, path, ))
return None
#
e.set('src', src)
return src
Expand Down Expand Up @@ -1938,7 +1941,8 @@ def element_sourcecode(self, e, p):
e.text = data
del e.attrib['src']

self.normalize_whitespace(e)
if e.text:
self.normalize_whitespace(e)

#
# 5.4.2.4 "Table of Contents" Insertion
Expand Down

0 comments on commit c4a4a0e

Please sign in to comment.