Executive brief
fast-xml-parser is a popular XML parsing library. A previous security patch that blocked regex injection attacks used a blacklist approach (checking for bad characters), which carries inherent risk of missing malicious characters. This advisory recommends a safer whitelist validation approach that verifies entity names match the XML specification, reducing future bypass risks.
Technical details
This advisory comments on the patch for CVE-2023-34104 (a regex injection via DOCTYPE entities that caused DoS). The initial patch in v4.2.4 validated entity names by checking for the presence of a hardcoded blacklist of dangerous characters (!?\/[]$%{}^&*()<>|+). This blacklist approach is inherently fragile—it is easy to overlook characters that could be abused for regex injection. A safer approach, implemented in v4.2.5, validates against a whitelist derived from the XML 1.1 specification (checking that entity names match the Name production rule, starting with NameStartChar and followed by zero or more NameChar). This shifts from "reject known bad" to "accept only known good", significantly reducing the risk of future bypasses through forgotten blacklist entries.
Affected products
- NaturalIntelligence fast-xml-parser 4.2.4
Timeline
- 2023-06-15: disclosed: Advisory GHSA-gpv5-7x3g-ghjv published commenting on patch adequacy
- 2023-06-13: patched: Version 4.2.5 released with improved whitelist-based validation