Merge pull request #922 from guardrails-ai/rail-xxe-fix

dtam · web-flow · commit f3d806afee31 · 2024-07-15T11:40:10.000-07:00
Rail XXE Fix
diff --git a/guardrails/classes/templating/constants_container.py b/guardrails/classes/templating/constants_container.py
@@ -17,7 +17,7 @@ def fill_constants(self) -> None:
         with open(constants_file, "r") as f:
             xml = f.read()
 
-        parser = ET.XMLParser(encoding="utf-8")
+        parser = ET.XMLParser(encoding="utf-8", resolve_entities=False)
         parsed_constants = ET.fromstring(xml, parser=parser)
 
         for child in parsed_constants:
diff --git a/guardrails/schema/rail_schema.py b/guardrails/schema/rail_schema.py
@@ -350,7 +350,7 @@ def rail_string_to_schema(rail_string: str) -> ProcessedSchema:
         validators=[], validator_map={}, exec_opts=GuardExecutionOptions()
     )
 
-    XMLPARSER = XMLParser(encoding="utf-8")
+    XMLPARSER = XMLParser(encoding="utf-8", resolve_entities=False)
     rail_xml: _Element = ET.fromstring(rail_string, parser=XMLPARSER)
 
     # Load <output /> schema

Original file line number	Diff line number	Diff line change
`@@ -350,7 +350,7 @@ def rail_string_to_schema(rail_string: str) -> ProcessedSchema:`
`350`	`350`	`validators=[], validator_map={}, exec_opts=GuardExecutionOptions()`
`351`	`351`	`)`
`352`	`352`
`353`		`- XMLPARSER = XMLParser(encoding="utf-8")`
	`353`	`+ XMLPARSER = XMLParser(encoding="utf-8", resolve_entities=False)`
`354`	`354`	`rail_xml: _Element = ET.fromstring(rail_string, parser=XMLPARSER)`
`355`	`355`
`356`	`356`	`# Load <output /> schema`