#521 Document fetch triggered by XML writer raw XML validation

[Florian Weimer]

Red Hat Product Security has asked me to forward the attached vulnerability report. I do not think it is a significant issue (perhaps no vulnerability at all), so I'm not filing a private bug for it.

This is a small reproducer:

from docutils.core import publish_string
RST_INPUT = """\
.. raw:: xml

   <!DOCTYPE r [<!ENTITY xxe SYSTEM "http://127.0.0.1:9/">]>
   <r>&xxe;</r>
"""
print(publish_string(RST_INPUT, writer_name='xml'))

It fails with a urllib.error.URLError exception, indicating that the conversion triggered unexpected network activity.

I've been told to mention: Found by AISLE in partnership with Red Hat

[Günter Milde]

Fixed in [r10395].