XML Injection

[Shaik Apsar]

The xml.dom.minidom module is not secure against maliciously constructed data. If you need to parse untrusted or unauthenticated data see XML vulnerabilities.

Trove code base is using xml.dom.minidom.

Writing unvalidated data into an XML document can allow an attacker to change the structure and contents of the XML.

https://github.com/openstack/trove/blob/129fac7d5374e18a428afa1b5c0259743677222e/trove/common/base_wsgi.py#L509

[Jeremy Stanley (fungi)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Tristan Cacqueray (tristan-cacqueray)]

trove-coresec, can the XMLDictSerializer be used with user supply data, or is it only processing known/safe xml object?

[Amrith Kumar (amrith)]

My suspicion is that this issue was found using some code inspection tool and not actual observation of an issue. As best as I can tell, this should not be an issue in practice but I will check and update.

[Amrith Kumar (amrith)]

Tristan, as best as I can tell from a quick review of the code, this is not a vulnerability but an opportunity for hardening. I will request additional review (others on trove-coresec) and update in the next day or two.

[Tristan Cacqueray (tristan-cacqueray)]

Amrith, any objections if we switch this to public and close the OSSA task?

[Amrith Kumar (amrith)]

Tristan, no objections.